[New Rules] Megalodon GitHub Actions supply chain backdoor — Linux endpoint detection (May 2026)

[StuLast]

Pull Request

Issue link(s): Closes #6217

Two new Linux endpoint detection rules for the Megalodon GitHub Actions supply chain backdoor
campaign (May 2026), which compromised 5,561 GitHub repositories via stolen Personal Access
Tokens pushing malicious workflow files.

Rules added:

File	Severity	Tactic	Risk Score
rules/linux/command_and_control_megalodon_c2_outbound.toml	Critical	Command and Control, Exfiltration	99
rules/linux/execution_megalodon_base64_exec_ci_runner.toml	High	Execution, Defense Evasion	73

Intelligence source: SafeDep.io, "Megalodon: Mass GitHub Repository Backdooring via CI
Workflows" (2026) — https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/

SafeDep.io are the source of all IoC data (C2 IP, workflow filenames). Detection rule logic is
original work by Spyced Concepts Ltd. SafeDep.io have been notified and credited in all rule
references.

Note on AI assistance: Detection rule logic was developed with AI assistance (Claude Sonnet
4.6). IoC intelligence is sourced entirely from SafeDep.io's original research.

Full rule set (YARA + Sigma + test harness with FP/FN scoring):
https://github.com/Spyced-Concepts/detection-rules

Why only Linux endpoint rules: Three GitHub audit log rules were drafted but excluded.
github.head_commit.added, github.head_commit.modified, and github.pull_request.id are not
present in the logs-github.audit-* field mapping, making file-path-based detection impossible
from audit log events. Those rules are retained in the companion repo pending an ECS/integration
enhancement to expose commit-level file path data.

How To Test

C2 outbound rule — query to verify in your stack:
host.os.type:linux and event.category:network and
destination.ip:"216.126.225.129" and destination.port:8443

Base64 exec rule — query to verify in your stack:
host.os.type:linux and event.category:process and
process.command_line:(base64 and ("-d" or "--decode")) and
process.command_line:("| bash" or "| sh" or "|bash" or "|sh") and
not process.parent.executable:(apt or dpkg or snap)

Both rules use standard ECS fields only (destination.ip, destination.port,
process.command_line, process.parent.executable). No custom field mappings required.

Checklist

• Added a label for the type of pr: Rule: New
• Secret and sensitive material has been managed correctly
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement? Yes ✓
• Have you followed the contributor guidelines? Yes ✓

[StuLast]

Could a maintainer please add the Rule: New label? I don't have write access to labels as an external contributor.