← Back to SOC feed Coverage →

GitHub Mass Deletion of repos or projects

kql MEDIUM Azure-Sentinel
T1485
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-04-24T09:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may delete a large number of GitHub repositories or projects to eliminate evidence or disrupt operations. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential compromise and mitigate lateral movement or data exfiltration risks.

KQL Query


let starttime = todatetime('{{StartTimeISO}}');
let endtime = todatetime('{{EndTimeISO}}');
let LearningPeriod = 7d;
let BinTime = 1h;
let EndLearningTime = starttime - LearningPeriod;
let NumberOfStds = 3;
let MinThreshold = 10.0;
let GitHubRepositoryDestroyEvents = (GitHubAudit
| where Action == "repo.destroy");
GitHubRepositoryDestroyEvents
| where TimeGenerated between (EndLearningTime .. starttime)
| summarize count() by bin(TimeGenerated, BinTime)
| summarize AvgInLearning = avg(count_), StdInLearning = stdev(count_)
| extend LearningThreshold = max_of(AvgInLearning + StdInLearning * NumberOfStds, MinThreshold)
| extend Dummy = 1
| join kind=innerunique (
  GitHubRepositoryDestroyEvents
  | where TimeGenerated between (starttime..endtime)
  | summarize CountInRunTime = count() by bin(TimeGenerated, BinTime)
  | extend Dummy = 1
) on Dummy
| project-away Dummy
| where CountInRunTime > LearningThreshold

Analytic Rule Definition

id: 67da5c4e-49f2-476d-96ff-2dbe4b855a48
name: GitHub Mass Deletion of repos or projects
description: |
  'This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise.'
requiredDataConnectors: []
tactics:
  - Impact
relevantTechniques:
  - T1485
query: |

  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let LearningPeriod = 7d;
  let BinTime = 1h;
  let EndLearningTime = starttime - LearningPeriod;
  let NumberOfStds = 3;
  let MinThreshold = 10.0;
  let GitHubRepositoryDestroyEvents = (GitHubAudit
  | where Action == "repo.destroy");
  GitHubRepositoryDestroyEvents
  | where TimeGenerated between (EndLearningTime .. starttime)
  | summarize count() by bin(TimeGenerated, BinTime)
  | summarize AvgInLearning = avg(count_), StdInLearning = stdev(count_)
  | extend LearningThreshold = max_of(AvgInLearning + StdInLearning * NumberOfStds, MinThreshold)
  | extend Dummy = 1
  | join kind=innerunique (
    GitHubRepositoryDestroyEvents
    | where TimeGenerated between (starttime..endtime)
    | summarize CountInRunTime = count() by bin(TimeGenerated, BinTime)
    | extend Dummy = 1
  ) on Dummy
  | project-away Dummy
  | where CountInRunTime > LearningThreshold

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/GitHub/Mass Deletion of Repositories .yaml