GitHub ci-tmp-hex branch create then delete with cache.yml workflow run deletion
Detects a suspicious sequence of events in GitHub where a temporary branch matching a specific pattern (ci-tmp-<hex>) is created or pushed, and subsequently deleted along with associated workflow runs in the same repository within a short time window.
Microsoft Sentinel (KQL)
