Megalodon CI/CD - NPM Token Harvesting
This rule detects the targeted extraction of NPM authentication tokens by monitoring process command lines for the string 'npm_' and correlating it with network connections to a specific IP address (216.126.225.129). This behavior is associated with the Megalodon CI/CD malware.
Microsoft Sentinel (KQL)
