Detects when SAML single sign-on (SSO) is disabled for a GitHub Enterprise or Organization by auditing GitHub audit logs for events 'business.disable_saml' and 'org.disable_saml'. Disabling SSO removes IdP-enforced controls, allowing members to authenticate with GitHub credentials alone. This can enable defense evasion and persistence after an account takeover, as IdP-revoked sessions or deprovisioning may not immediately revoke access. The rule surfaces fields including timestamp, user.name, github.org, github.repo, github.actor_ip, github.hashed_token, github.programmatic_access_type, github.user_agent, and github.business to help determine scope, method (interactive UI vs token), and potential attacker indicators. It maps to MITRE ATT&CK techniques T1562 (Impair Defenses) and T1556 (Modify Authentication Process; Hybrid Identity), reflecting defense-evasion, credential access, and persistence use cases. Investigators should verify authorization, correlate with change tickets, and pivot on token-based activity. Remediation includes re-enabling SSO, invalidating active sessions, revoking tokens and credentials issued during the window, and hardening controls to prevent unauthorized future changes.