Shai-Hulud GitHub exfil repo with 'Here We Go Again' description
Detects endpoint process executions interacting with the GitHub API to create repositories containing specific markers, followed closely by workflow commits or configuration changes within a specified timeframe.
Microsoft Sentinel (KQL)

