Repository

Detection of unauthorized GitHub repository deletion within an organization, potentially leading to irreversible data loss and indicating compromise.

Detection of GitHub repository archiving or unarchiving events, which could indicate malicious activity such as persistence, impact, or defense impairment.

An adversary may change a private GitHub repository to public visibility to exfiltrate sensitive code or data, potentially indicating a compromise or unauthorized access, and immediately fork or mirror the repo to an external account to retain access and harvest embedded secrets.

This brief analyzes navigation options within a GitHub repository, focusing on the splunk/security_content repository, and highlights potential areas for security content discovery and monitoring.

This analytic detects the archival of a repository within a GitHub Organization, potentially indicating malicious activity such as attempts to make code inaccessible, insider threats, or account compromise.

Anomalous deletion of a GitHub organization repository can indicate malicious activity aimed at destroying source code, intellectual property, or evidence of compromise, potentially stemming from account compromise, insider threats, or business disruption attempts.