GitHub CLI Token Theft by Package Process
This rule detects attempts by package management processes (like npm or bun) to invoke the GitHub CLI (gh.exe) with commands that could be used to steal session tokens. This activity is suspicious as it suggests a potential supply-chain compromise targeting developer machines, where maintainers are high-value targets. The rule specifically looks for 'gh.exe' or 'gh' being executed with 'auth' and 'token' in the command line, initiated by 'node.exe', 'bun.exe', or 'npm.cmd'.
Microsoft Sentinel (KQL)
