Malicious GitHub Actions Workflow Targeting Self-Hosted Runners for Identity Recon
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Sigma
