Python Process Memory Scraping for Secrets
Detects Python processes attempting to read process memory (/proc/*/mem) or using a specific shell pipeline to scrape GitHub Actions Runner memory for masked secrets, as observed in the Mini Shai-Hulud supply chain attack.
Microsoft Sentinel (KQL)
