TeamPCP fallback exfiltration via tpcp-docs or docs-tpcp GitHub repo creation
Detects the creation of specific GitHub repositories ('tpcp-docs' or 'docs-tpcp') associated with TeamPCP stealer fallback exfiltration activity, including subsequent release or asset creation.
Splunk (SPL)
