GitHub Runner Process Discovery via Process Enumeration
Detects attempts to discover GitHub runner processes (Runner.Worker or Runner.Listener) using process enumeration tools like pgrep, ps, or grep. Adversaries may use this technique to locate processes carrying secrets on compromised CI/CD runners.
Microsoft Sentinel (KQL)
