User First Time Repository Delete Activity.yaml

id: c3237d88-fdc4-4dee-8b90-118ded2c507c
name: GitHub First Time Repo Delete
description: |
  'This hunting query identifies GitHub activites its the first time a user deleted a repo that may be a sign of compromise.'
requiredDataConnectors: []
tactics:
  - Impact
relevantTechniques:
  - T1485
query: |

  let starttime = todatetime('{{StartTimeISO}}');
  let endtime = todatetime('{{EndTimeISO}}');
  let LearningPeriod = 7d;
  let EndLearningTime = starttime - LearningPeriod;
  let GitHubRepositoryDestroyEvents = (GitHubAudit
  | where Action == "repo.destroy");
  GitHubRepositoryDestroyEvents
  | where TimeGenerated between (EndLearningTime .. starttime)
  | distinct Actor
  | join kind=rightanti (
    GitHubRepositoryDestroyEvents
    | where TimeGenerated between (starttime .. endtime)
    | distinct Actor
  ) on Actor