Audit-Log

Detection of a user pausing audit log event streaming in GitHub Enterprise, potentially indicating an attempt to evade detection by disabling the audit trail.

Detection of changes to self-hosted runner configurations in GitHub environments can indicate potential impact, discovery, collection, persistence, privilege escalation, initial access, or stealth activities.

A user pausing the audit log event stream in GitHub Enterprise, potentially indicating an attempt to evade detection by disabling audit trails.

Detection of modifications or disabling of audit log event streaming in GitHub Enterprise, potentially indicating an attacker attempting to evade detection by tampering with the audit trail.