CI/CD Environment Variable Enumeration by Malicious Extension Process (GITHUB_*/CI_*/Azure DevOps)
Detects process activity referencing GitHub Actions, GitLab CI, or Azure DevOps pipeline environment variable names (GITHUB_*, CI_*, GITHUB_ACTIONS, GITLAB_CI, Azure DevOps pipeline variables) consistent with a malicious extension harvesting CI/CD runner environment variables.
Cortex XDR
