Megalodon CI/CD - Base64 Decoded Runner Execution
Detects CI/CD runners utilizing inline base64 decoding to execute malware payloads, specifically looking for processes that use 'base64 -d' in their command line and also initiate network connections to a known malicious IP address (216.126.225.129) while using 'curl' or 'wget'.
Microsoft Sentinel (KQL)
