All Detections

Nord-Stream GitHub Secrets Exfil (T1212)

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026007

Identifies process execution patterns matching the open-source nord-stream tool, abused by the actor to steal GitHub Actions secrets.

Microsoft Sentinel (KQL)