GitLab Runner Installed as Auto-Start LocalSystem Service
Detects the creation or modification of a Windows service configured for automatic startup under the LocalSystem account that references the GitLab Runner executable. This pattern is commonly used for persistence via CI/CD runner abuse, including threats like the Shai-Hulud worm.
Microsoft Sentinel (KQL)
