GitHub Repository Archive Status Changed

SigmaHQ Detections@sigmaHQ

•updated Nov 3, 2025•1•0•34

Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. This action can be used by adversaries for various purposes, including defense evasion by hiding malicious repositories, persistence by making a repository less likely to be deleted, or impact by disrupting access to legitimate codebases.