Gheist ci-sync branch push planting sync-check.yml workflow in GitHub

ills3c Intel&Coffee@Ills3C

•updated yesterday•2•0•5

Detects Gheist campaign activity: creation of a ci-sync-<6 chars> branch via stolen GitHub token followed within 10 minutes by a workflow run on that branch in the same repo. Requires GitHub audit log ingestion; table name is an assumption.