Malicious GitHub Workflow Format Check Creation
This rule alerts when a new format-check workflow is created matching malicious supply-chain templates. These workflows run on every push and can steal secrets. Require security review for all new workflow files. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
