GitHub Enterprise Audit Log Stream Destroyed
This rule detects when a GitHub Enterprise audit log stream is destroyed. Adversaries may destroy audit log streams to remove evidence of their activities and evade detection. This action indicates an attempt to impair defenses by disabling or modifying cloud logging capabilities.
YARA-L
