Multiple YAML File Modifications in Config/Pipeline Folders

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•7

This rule detects when a single process modifies or creates three or more YAML files ('.yaml' or '.yml' extensions) within folders containing 'config' or 'pipeline' in their path, within a one-hour window. This behavior could indicate an attacker modifying configuration or deployment files, potentially for persistence, defense evasion, or impact.