GemStuffer Campaign: Host-Based Burst of 'oai'-Branded Gem Push Commands
Detects high-velocity publication of Ruby packages by an account that uses naming conventions related to 'OAI' or a known-malicious contact email. This behavior is indicative of a supply chain attack involving the automated deployment of numerous malicious packages to the RubyGems ecosystem.
Microsoft Sentinel (KQL)
