LoFP / validate the deletion activity is permitted. the \"actor\" field need to be validated.

Techniques

• t1213
• t1213.003

Sample rules

Github Delete Action Invoked

• source: sigma
• technicques:
  • t1213
  • t1213.003

Description

Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Detection logic

condition: selection
selection:
  action:
  - codespaces.delete
  - environment.delete
  - project.delete
  - repo.destroy