GitHub Repository Archive Status Changed

 1title: GitHub Repository Archive Status Changed
 2id: dca8991c-cb16-4128-abf8-6b11e5cd156f
 3status: experimental
 4description: |
 5        Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
 6references:
 7    - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
 8    - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
 9    - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
10author: Ivan Saakov
11date: 2025-10-18
12tags:
13    - attack.persistence
14    - attack.defense-evasion
15    - attack.impact
16logsource:
17    product: github
18    service: audit
19detection:
20    selection:
21        action:
22            - 'repo.archived'
23            - 'repo.unarchived'
24    condition: selection
25falsepositives:
26    - Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized.
27level: low

References

• Archiving repositories - GitHub Docs

  

  You can archive a repository to make it read-only for all users and indicate that it's no longer actively maintained. You can also unarchive repositories that have been archived.

  
  Read More

• Exploiting Repos | 6 Ways Threat Actors Abuse GitHub & Other DevOps Platforms

  

  Learn how cyber criminals exploit CI/CD environments to hide malware traffic, host malicious payloads and steal API keys and other enterprise data.

  
  Read More

• Security log events - GitHub Docs

  

  Learn about security log events recorded for your personal account.

  
  Read More

Related rules

• AWS SAML Provider Deletion Activity
• Potentially Suspicious Desktop Background Change Using Reg.EXE
• Potentially Suspicious Desktop Background Change Via Registry
• Github Self Hosted Runner Changes Detected
• APT27 - Emissary Panda Activity