Void Dokkaebi - Environment Variable Dumping

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•7

Detects commands exporting all environment variables (env, set, printenv) to a file, often used to steal CI/CD secrets on developer workstations. The rule specifically looks for these commands being executed by common scripting/execution environments like node.exe, python.exe, bash, or cmd.exe.