CI Runner Memory Secret Scraping
Detects processes attempting to scrape unmasked CI runner secrets from memory or using specific grep patterns associated with the Miasma worm. The worm escalates privileges to read Runner.Worker memory directly, bypassing standard GitHub Actions secret masking.
Sigma
