GitLab Runner Spawning PowerShell as SYSTEM - GitRunner C2
Detects the GitLab Runner process (gitlab-runner-windows-amd64.exe) spawning PowerShell with command-line arguments indicative of a C2 framework or manual operator interaction, such as '-NoProfile', '-NonInteractive', '-ExecutionPolicy Bypass', and '-Command'. The rule specifically targets instances where these processes are executed under the SYSTEM account, a behavior commonly associated with exploiting CI/CD runners for persistent command execution.
Microsoft Sentinel (KQL)
