Potential Secret Discovery Within Build or Runner Environment
Detects command-line activity searching for secret-related values within application or runner configurations. Attackers commonly enumerate secrets, credentials, API keys, and environment variables immediately after gaining access to CI/CD infrastructure.
Microsoft Sentinel (KQL)
