Sigma rule: GitHub Repository Archive Status Changed

Rule

Title

GitHub Repository Archive Status Changed

Status

experimental

Level

low

Author

Ivan Saakov

Date

2025-10-18

File

rules/application/github/audit/github_repository_archive_status_changed.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.

Log source

product

github

service

audit

Detection

selection:
    action:
        - 'repo.archived'
        - 'repo.unarchived'
condition: selection

False positives (as the rule lists them)

• Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized.

Tags

• attack.persistence
• attack.impact
• attack.defense-impairment

References

• https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
• https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
• https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/github/audit/github_repository_archive_status_changed.yml