GitHub Repository Created by Service Account or Integration

Detects repository creation activity initiated by service accounts, integrations, or automated identities. Unexpected repository creation may indicate compromised CI/CD credentials, unauthorized automation, or preparation for source code exfiltration.

Microsoft Sentinel (KQL)