Elastic Security Detection Rules

GitHub SSH or Deploy Key Added

Last updated 2 months ago on 2026-09-22
Created 2 months ago on 2026-09-22

About

Identifies the addition of an SSH public key to a GitHub user account or a deploy key to a repository. These keys grant Git access over SSH, so an adversary can add one to maintain persistent repository access after the original password, session, or token is revoked. Note that a user-level `public_key.create` action may not appear in a non-EMU enterprise audit stream, where it is retained only in the per-user security log.
Tags
Domain: CloudDomain: SaaSPlatform: GitHubUse Case: Threat DetectionTactic: PersistenceData Source: GithubData Source: GitHub Audit LogsRule Type: ES|QLLanguage: esql
Severity
low
Risk Score
21
MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Account Manipulation (T1098)(external, opens in a new tab or window)

False Positive Examples
Developers adding a key for a new workstation, or administrators adding an approved deploy key for CI/CD or repository automation. Confirm the key, source IP, affected account or repository, and expected access level.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

github(external, opens in a new tab or window)

Query
text code block:
from logs-github.audit-* metadata _id, _index, _version
| where
  event.module == "github" and data_stream.dataset == "github.audit"
    and event.action == "public_key.create"
| keep
    _id,
    _index,
    _version,
    @timestamp,
    event.action,
    user.name,
    github.org,
    github.repo,
    github.actor_ip,
    github.hashed_token,
    github.programmatic_access_type,
    github.user_agent

Install detection rules in Elastic Security

Detect GitHub SSH or Deploy Key Added in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).