GitHub Repository Pages Site Changed to Public

 1title: GitHub Repository Pages Site Changed to Public
 2id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55
 3status: experimental
 4description: |
 5        Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.
 6references:
 7    - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
 8    - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
 9    - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
10author: Ivan Saakov
11date: 2025-10-18
12tags:
13    - attack.collection
14    - attack.exfiltration
15    - attack.t1567.001
16logsource:
17    product: github
18    service: audit
19detection:
20    selection:
21        action: 'repo.pages_public'
22    condition: selection
23falsepositives:
24    - Legitimate publishing of repository pages by authorized users
25level: low

References

• Creating a GitHub Pages site - GitHub Docs

  

  You can create a GitHub Pages site in a new or existing repository.

  
  Read More

• Exploiting Repos | 6 Ways Threat Actors Abuse GitHub & Other DevOps Platforms

  

  Learn how cyber criminals exploit CI/CD environments to hide malware traffic, host malicious payloads and steal API keys and other enterprise data.

  
  Read More

• Security log events - GitHub Docs

  

  Learn about security log events recorded for your personal account.

  
  Read More

Related rules

• Shai-Hulud NPM Package Malicious Exfiltration via Curl
• Network Connection Initiated To DevTunnels Domain
• Data Compressed
• Compressed File Creation Via Tar.EXE
• Compressed File Extraction Via Tar.EXE