GitHub Repo Created as Credential Drop from Endpoint
This rule detects the creation of a new GitHub repository from a compromised endpoint, specifically looking for indicators of stolen credential exfiltration. The rule identifies GitHub application events where a repository is created and the raw event data contains keywords associated with credential dumping or specific campaign names like "Miasma" or "Spreading Blight". Automated exfiltration to GitHub is often fast and difficult to remediate, making prompt detection crucial. If triggered, it's recommended to revoke tokens used to create the repository and investigate the endpoint for compromise.
Microsoft Sentinel (KQL)
