GitHub - Repository was destroyed

Status: available
Severity: medium
Time window: 7d
Source: github.com/Azure/Azure-Sentinel

Detect activities when a repository was destroyed. This query runs every day and its severity is Medium.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
GitHub	Audit log action `repo.destroy`: Repository deleted

Rules detecting the same action

These rules filter on the same operation.

Github Delete Action Invoked (Sigma)
GitHub Enterprise Repository Deleted (Splunk)
GitHub Organizations Repository Deleted (Splunk)
GitHub Repository Archived Or Deleted (YARA-L)
GitHub Repository Deleted (Elastic)

Rule body

id: 0b85a077-8ba5-4cb5-90f7-1e882afe10c3
name: GitHub - Repository was destroyed
description: |
  'Detect activities when a repository was destroyed. This query runs every day and its severity is Medium.'
severity: Medium
status: Available
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 7d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1078
query: |
    GitHubAuditData
    | where Action == "repo.destroy"
    | extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Actor
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

GitHubAuditData

Stage 2: `where`

| where Action == "repo.destroy"

Stage 3: `extend`

| extend AccountName = tostring(split(Actor, "@")[0]), AccountUPNSuffix = tostring(split(Actor, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	eq	`repo.destroy`	`field:"Action" kind:eq value:"repo.destroy"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`