CI/CD Secret Exfiltration via Artifacts (IronWorm)
Detects suspicious attempts to dump serialized GitHub Actions secrets (JSON) into a text file named 'format-results.txt' for subsequent artifact exfiltration, a technique used by IronWorm. The rule looks for shell commands that use 'echo' to write to 'format-results.txt' and contain references to 'VARIABLE_STORE' or 'secrets', indicating an attempt to exfiltrate sensitive CI/CD environment variables.
Microsoft Sentinel (KQL)
