Shai-Hulud Malicious GitHub Workflow Creation
Detects the creation of the 'shai-hulud-workflow.yml' file, which is associated with the Shai Hulud worm. This worm targets the NPM supply chain and is designed to exfiltrate GitHub secrets. The rule specifically looks for the creation of this file within the '.github/workflows/' directory.
Sigma
