GitHub Enterprise: Audit log streaming modification or destruction

GitHub Enterprise audit log streaming provides a durable record of enterprise events. Unauthorized modification or deletion of these streams allows attackers to evade detection by preventing audit logs from reaching the configured SIEM destination or by hijacking the data stream. This activity is considered a significant defense evasion technique.

Impact

Unauthorized modification of audit log streams results in a loss of security visibility. If the production SIEM destination is deleted or reconfigured to an untrusted endpoint, security operations teams will lose the ability to detect subsequent malicious activity within the GitHub environment.

Recommendation

• Implement monitoring for audit_log_streaming.update and audit_log_streaming.destroy events in GitHub Enterprise audit logs.
• Establish a process to audit current GitHub Enterprise streaming configurations against known-good baselines.
• Review credentials of all enterprise owners to ensure minimal privilege and verify that MFA is enforced for all administrative access.
• If a production stream is destroyed, immediately verify the integrity of the remaining logs and initiate an incident response procedure to rotate credentials and investigate for further unauthorized access.