Detects creation or deletion of a GitHub SSH certificate authority (CA), or disabling the requirement that members use SSH certificates, for an organization or enterprise. A CA lets an org issue short-lived SSH certificates and optionally require them in place of personal SSH keys, centralizing and time-bounding Git access. Destroying the CA or dropping the requirement makes ordinary unmanaged SSH keys acceptable again. Following an account takeover, an adversary may make these changes to authenticate with keys the organization does not manage and evade certificate-based access control, making this a high-impact change to Git access controls. The rule maps to MITRE ATT&CK techniques T1562.001 (Disable or Modify Tools) and T1556 (Modify Authentication Process), reflecting defense evasion and persistence implications. The detection uses GitHub audit log events for actions ssh_certificate_authority.create, ssh_certificate_authority.destroy, and ssh_certificate_requirement.disable, and surfaces fields such as user.name, github.org, github.actor_ip, github.hashed_token, github.programmatic_access_type, github.user_agent, and github.business to aid triage. Possible investigation steps include validating the actor’s privileges, assessing the scope and legitimacy of the change, distinguishing legitimate CA rotation from tampering, verifying the existence of a replacement CA, and reviewing subsequent Git access for unmanaged keys. Remediation emphasizes restoring centralized control, re-enabling the SSH certificate requirement, revoking unmanaged keys, rotating owner credentials if needed, and hardening controls to alert on future CA changes.