GitHub branch protection disabled then force-push and lookalike litellm repo
Detects a sequence of security-sensitive events in GitHub repositories where branch protection rules are modified or removed, followed closely by a force push to the protected repository, and subsequent workflow activity involving the Berri-AI/litellm repository or similar context. This pattern often indicates malicious tampering with repository controls to introduce unauthorized code.
Microsoft Sentinel (KQL)
