Multiple GitHub Force Pushes to Tags Detected
Detects a high volume of 'git push --force' events specifically targeting tags from a single user or to a single repository within a short timeframe. This is a strong indicator of a tag poisoning campaign, similar to the one used in the supply chain attack against the 'aquasecurity/trivy-action' repository where 75 tags were force-pushed to point to malicious code.
Sigma
