GitHub High Risk Configuration Disabled

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•2•0•50

This rule detects when a user disables critical security features within a GitHub organization or repository. This includes disabling advanced security features, OAuth app access restrictions, or two-factor authentication requirements. Such actions can significantly weaken the security posture of a GitHub environment, potentially leading to unauthorized access or compromise.