Detects bypass or disabling of GitHub Secret Scanning Push Protection at enterprise, organization, or repository scope (or for newly created repos) and distinguishes these events from turning secret scanning off. The rule triggers on audit-log events such as: secret_scanning_push_protection.bypass, secret_scanning_push_protection_request.approve, and disable actions at various scopes (business/org/repository) including new_repos_disable variants. It does not flag normal disallowance of pushes, but focuses on when a detected secret is allowed to land or the push protection is actively disabled. Investigation focuses on who performed the action, source of access (UI vs. token), and the resulting commit for potential secret leakage. Key extracted fields include user.name, github.org, github.repo, github.actor_ip, github.hashed_token, github.programmatic_access_type, github.user_agent, and github.secret_type to determine legitimacy and method of bypass. The rule maps to MITRE ATT&CK Defense Evasion (T1562, with T1562.001 Disable or Modify Tools) and is intended to support threat detection, incident response, and compliance monitoring for GitHub workflows and secrets handling. Typical responses include re-enabling push protection, rotating the bypassed secret, restricting who can bypass or disable protections, and reviewing bypass lists and related credential events. The rule also covers correlating with other control changes (secret scanning status, bypass entries, new owners, PAT grants) to identify broader tampering. False positives may arise from security testing with dummy values or temporary maintenance disables; validation should confirm no live secret was pushed and the control is re-enabled afterward. Remediation guidance includes re-enabling push protection at the affected scope, rotating compromised secrets, restricting bypass privileges, and auditing Actions secrets and PATs for the same window. References and context are provided to GitHub’s push protection documentation and related Sigma rule mappings.