GitHub Enterprise Audit Log Stream Modified

Google SecOps@GoogleSecOps

•updated Mar 10, 2025•2•0•40

Detects when a GitHub audit log stream is modified (e.g., paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks, which is a common defense evasion technique.