RubyDoc build RCE followed by API key harvesting attempts
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Microsoft Sentinel (KQL)
