CI/CD Runner - Base64 Decode Piped to sudo python3 for Credential Harvesting
Detects suspicious execution patterns on CI/CD runners involving the decoding of base64-encoded payloads piped into sudo python3, which is often used for credential harvesting. The rule identifies this behavior through two methods: sibling process correlation where 'base64 -d' and 'sudo python3' occur within 60 seconds of each other, and the observation of interpreters (sh, bash, python, etc.) launched without arguments in conjunction with runner-specific process patterns, indicative of stdin-piped execution.
Microsoft Sentinel (KQL)
