Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1562-impair-defenses

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a GitHub audit log stream has been deleted.

Strategy

This rule monitors GitHub audit logs for when an audit log stream is deleted. An attacker may remove an audit log stream to evade defenses set up by a security team.

Triage and response

1. Determine if the change taken by {{@github.actor}} is authorized.
2. If the change was not authorized or was unexpected, begin your organization’s incident response process and investigate.