CI/CD - Runner - Malicious GitHub Action Component Injecting Credential-Harvesting Scripts
Detects suspicious process execution by GitHub Runner.Worker or Runner.Listener on CI runners. It specifically targets the execution of scripts or binaries associated with compromised action components (such as trivy-action or setup-trivy) where version tags have been tampered with to inject credential-harvesting code. The rule monitors for unauthorized command line arguments or file paths linked to these components.
Microsoft Sentinel (KQL)
