Miasma Fake Dependabot GitHub Actions Workflow Pushing Malicious npm-publish.yml
This rule monitors GitHub audit logs for potentially malicious activities in repository management and CI/CD workflows. It detects suspicious commits by specific maintainers, impersonation of the Dependabot bot, usage of non-standard snapshot branch naming conventions, execution of unauthorized workflows, and specific commit message patterns indicative of unauthorized system modifications or testing.
Cortex XDR
