Deletion of CI Workflow Files with Anomalous Branch Creation
Detects deletion of GitHub Actions workflow files combined with anomalous branch names/commit hashes, indicating the attacker concealing the malicious CI workflow used in this supply-chain compromise.
Microsoft Sentinel (KQL)
