This detection rule watches for GitHub audit events of the public_key.create action, which records the addition of an SSH public key to a user account or the addition of a deploy key to a repository. SSH keys provide durable Git access independent of passwords or tokens, enabling an adversary to maintain persistence after credential compromise. The rule captures context such as the actor (user.name), source IP (github.actor_ip), organization (github.org), repository (github.repo), and key usage indicators (github.hashed_token, github.programmatic_access_type, github.user_agent). It distinguishes between a user-level key and a deploy key, and flags activity that may indicate unauthorized persistence. The behavior is aligned with MITRE ATT&CK Persistence techniques, specifically T1098 (Account Manipulation) and subtechnique T1098.001 (Additional Cloud Credentials), under the Persistence tactic (TA0003). Note that in some environments (e.g., non-EMU enterprises), user-level public_key.create events may not surface in enterprise audit streams and may appear only in per-user security logs. The rule provides a structured path to investigate, correlate with related activity, and identify potential abuse of newly added keys, including the type of access granted by deploy keys. The detection is categorized as low severity with a risk score of 21, reflecting that while abuse can have serious implications, the event itself may be legitimate in many development or automation scenarios. If unauthorized, remediation includes immediately removing the key, rotating affected credentials, auditing related SSH keys, tokens, and OAuth authorizations, and hunting for subsequent Git activity that used the key. Investigation guidance emphasizes verifying key type (user vs deploy), validating the owner and purpose, examining the originating IP and user agent, and correlating with other account changes and repository activity. False positives include developers adding a key for a workstation, CI/CD automation deploy keys, or approved onboarding flows; ensure appropriate exceptions align with documented workflows.