GitHub Delete Action Invoked

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•1•0•36

Detects delete actions within GitHub audit logs related to codespaces, environments, projects, and repositories. This can indicate an attempt to remove critical development infrastructure or source code.