Coderd Provisioner Process Exfiltrating DB/Auth Secrets via dlp.sh
Detects execution of Coder-related processes or scripts where sensitive configuration parameters, such as database credentials or authentication tokens, are passed via command-line arguments. This behavior can lead to the exposure of credentials to other users or processes on the system through process listing.
Microsoft Sentinel (KQL)
