CI Runner Memory Secret Scraping
Detects processes attempting to scrape unmasked CI runner secrets from memory, specifically looking for techniques used by the Miasma worm to bypass GitHub Actions secret masking. This rule identifies suspicious command-line patterns indicative of secret extraction, such as searching for 'isSecret' or accessing '/proc/mem' with Python.
Microsoft Sentinel (KQL)
