[New Rules] Megalodon GitHub Actions supply chain backdoor — Linux endpoint detection (May 2026)

[StuLast]

Pull Request

Issue link(s): Closes #6217

Two new Linux endpoint detection rules for the Megalodon GitHub Actions supply chain backdoor
campaign (May 2026), which compromised 5,561 GitHub repositories via stolen Personal Access
Tokens pushing malicious workflow files.

Rules added:

File	Severity	Tactic	Risk Score
rules/linux/command_and_control_megalodon_c2_outbound.toml	Critical	Command and Control, Exfiltration	99
rules/linux/execution_megalodon_base64_exec_ci_runner.toml	High	Execution, Defense Evasion	73

Intelligence source: SafeDep.io, "Megalodon: Mass GitHub Repository Backdooring via CI
Workflows" (2026) — https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/

SafeDep.io are the source of all IoC data (C2 IP, workflow filenames). Detection rule logic is
original work by Spyced Concepts Ltd. SafeDep.io have been notified and credited in all rule
references.

Note on AI assistance: Detection rule logic was developed with AI assistance (Claude Sonnet
4.6). IoC intelligence is sourced entirely from SafeDep.io's original research.

Full rule set (YARA + Sigma + test harness with FP/FN scoring):
https://github.com/Spyced-Concepts/detection-rules

Why only Linux endpoint rules: Three GitHub audit log rules were drafted but excluded.
github.head_commit.added, github.head_commit.modified, and github.pull_request.id are not
present in the logs-github.audit-* field mapping, making file-path-based detection impossible
from audit log events. Those rules are retained in the companion repo pending an ECS/integration
enhancement to expose commit-level file path data.

How To Test

C2 outbound rule — query to verify in your stack:
host.os.type:linux and event.category:network and
destination.ip:"216.126.225.129" and destination.port:8443

Base64 exec rule — query to verify in your stack:
host.os.type:linux and event.category:process and
process.command_line:(base64 and ("-d" or "--decode")) and
process.command_line:("| bash" or "| sh" or "|bash" or "|sh") and
not process.parent.executable:(apt or dpkg or snap)

Both rules use standard ECS fields only (destination.ip, destination.port,
process.command_line, process.parent.executable). No custom field mappings required.

Checklist

• Added a label for the type of pr: Rule: New
• Secret and sensitive material has been managed correctly
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement? Yes ✓
• Have you followed the contributor guidelines? Yes ✓

[StuLast]

Could a maintainer please add the Rule: New label? I don't have write access to labels as an external contributor.

[Copilot]

Pull request overview

Adds two new Linux Elastic Defend endpoint detection rules to identify post-compromise activity associated with the Megalodon GitHub Actions supply-chain backdoor campaign (May 2026), focusing on (1) known C2 egress and (2) the base64-decode-and-execute payload delivery pattern seen in malicious workflows.

Changes:

• Added an IoC-based endpoint network rule for connections to the reported Megalodon C2 (216.126.225.129:8443).
• Added a behavior-based endpoint process rule for base64-decoded payloads being piped into bash/sh on CI runners, including investigation guidance and ATT&CK mappings.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
rules/linux/command_and_control_megalodon_c2_outbound.toml	New Linux endpoint network rule for Megalodon C2 destination IP/port.
rules/linux/execution_megalodon_base64_exec_ci_runner.toml	New Linux endpoint process rule for base64 decode → pipe-to-shell execution pattern used by the campaign.