Sigma rule: GitHub Repository Pages Site Changed to Public

Rule

Title

GitHub Repository Pages Site Changed to Public

Status

experimental

Level

low

Author

Ivan Saakov

Date

2025-10-18

File

rules/application/github/audit/github_pages_site_changed_to_public.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.

Log source

product

github

service

audit

Detection

selection:
    action: 'repo.pages_public'
condition: selection

False positives (as the rule lists them)

• Legitimate publishing of repository pages by authorized users

Tags

• attack.collection
• attack.exfiltration
• attack.t1567.001

MITRE ATT&CK ids this rule names

• T1567.001

References

• https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
• https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
• https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/github/audit/github_pages_site_changed_to_public.yml