Miasma Mini Shai-Hulud Poisoned GitHub Actions Workflow Secrets Exfil
Detects suspicious activities within GitHub repository logs that indicate potential supply chain attacks, including the use of unauthorized workflow names, the creation of orphan snapshot branches, dependabot impersonation attempts, commit messages containing known campaign markers, exposure of internal secrets (HAS_GCR_TOKEN), and the push of suspicious files or configuration modifications.
Microsoft Sentinel (KQL)
