Miasma Exfiltration Payload Staging and Git Operations
Detects the staging of Miasma exfiltration payloads, specifically JSON files matching the 'results-*.json' naming convention, and Git operations interacting with these files. Miasma is known to exfiltrate harvested credentials by creating public GitHub repositories and committing encrypted JSON files with this specific naming convention.
Microsoft Sentinel (KQL)
