GitHub Actions OIDC Credential Pair Exposure
This rule looks for exposed pairs of credentials used for GitHub cloud identity federation in logs or artifacts. Leaked pairs let attackers mint tokens as your pipeline. Rotate federation settings and audit recent workflow runs.
Microsoft Sentinel (KQL)
