Passwordless sudo rule for runner user
This rule looks for adding a passwordless sudo rule for a CI runner account on Linux. Attackers who gain runner access can then become root freely. Remove the rule and audit runner images. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
