Miasma Fake Dependabot GitHub Actions Workflow Injecting CI/CD Secrets
Detects specific malicious activity patterns associated with the Miasma/Mini Shai-Hulud campaign targeting GitHub repositories. The rule monitors for unauthorized workflow creation, specific suspicious commit messages, and the use of orphan branches that impersonate dependabot or mimic specific campaign indicators.
Splunk (SPL)
