GitHub Actions Workflow Created
Detects creation of a GitHub Actions workflow. A workflow executes code on runners with access to repository secrets, so a malicious one is both a code-execution primitive and a route to every credential the repository holds — a supply chain foothold reached entirely through legitimate platform features. Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870). Integration guide: https://bloo.io/docs/hypercloud/github-connector BQL (Bloo Query Language): stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED' | groupby target, repositoryid, headbranch, operationtype
Sigma
