GitHub branch workflow deletion after artifact download
This rule detects when a GitHub workflow branch is deleted shortly after build artifacts were downloaded. This behavior can indicate an attacker attempting to hide their tracks after exfiltrating secrets or sensitive information from build artifacts. It is crucial to preserve logs and investigate who deleted the branch. Further investigation should include questioning the user about recent software installations or clicked links, and involving the security team if the answers are unclear.
Microsoft Sentinel (KQL)
