← Back to SOC feed Coverage →

GitHub First Time Repo Delete

kql MEDIUM Azure-Sentinel
T1485
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-04-24T09:00:00Z · Confidence: medium

Hunt Hypothesis

An adversary may delete a GitHub repository for the first time as part of initial compromise to eliminate forensic evidence. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential early-stage malware or exfiltration activities.

KQL Query


let starttime = todatetime('{{StartTimeISO}}');
let endtime = todatetime('{{EndTimeISO}}');
let LearningPeriod = 7d;
let EndLearningTime = starttime - LearningPeriod;
let GitHubRepositoryDestroyEvents = (GitHubAudit
| where Action == "repo.destroy");
GitHubRepositoryDestroyEvents
| where TimeGenerated between (EndLearningTime .. starttime)
| distinct Actor
| join kind=rightanti (
  GitHubRepositoryDestroyEvents
  | where TimeGenerated between (starttime .. endtime)
  | distinct Actor
) on Actor

Analytic Rule Definition

id: c3237d88-fdc4-4dee-8b90-118ded2c507c
name: GitHub First Time Repo Delete
description: |
  'This hunting query identifies GitHub activites its the first time a user deleted a repo that may be a sign of compromise.'
requiredDataConnectors: []
tactics:
  - Impact
relevantTechniques:
  - T1485
query: |

  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let LearningPeriod = 7d;
  let EndLearningTime = starttime - LearningPeriod;
  let GitHubRepositoryDestroyEvents = (GitHubAudit
  | where Action == "repo.destroy");
  GitHubRepositoryDestroyEvents
  | where TimeGenerated between (EndLearningTime .. starttime)
  | distinct Actor
  | join kind=rightanti (
    GitHubRepositoryDestroyEvents
    | where TimeGenerated between (starttime .. endtime)
    | distinct Actor
  ) on Actor

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/GitHub/User First Time Repository Delete Activity.yaml