{"id":"5bac7a56-da88-4c27-922e-c81e113b20cb","title":"Github Self-Hosted Runner Execution","description":"Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.\nShai-Hulud is an npm supply chain worm targeting CI/CD environments.\nIt installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.\n","author":"Daniel Koifman (KoifSec)","status":"test","level":"medium","date":"2025-11-29","modified":"","tags":["attack.command-and-control","attack.t1102.002","attack.t1071"],"technique_ids":["T1071","T1102.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure","Authorized runner deployments by DevOps/Platform teams following change management","Scheduled runner updates or reconfigurations on existing build agents","Self-hosted runners that follow expected/known naming patterns","Installation via expected/known configuration management tools (reflected mostly as parent process name)"],"references":["https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/","https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/"],"source_path":"rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml","source_sha256":"7e648ada2e3395953a6958b8eac9adf09ec368d657ad1fe34459bf2706ad4bb1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Github Self-Hosted Runner Execution\nid: 5bac7a56-da88-4c27-922e-c81e113b20cb\nstatus: test\ndescription: |\n    Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.\n    Shai-Hulud is an npm supply chain worm targeting CI/CD environments.\n    It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.\nreferences:\n    - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/\n    - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/\nauthor: Daniel Koifman (KoifSec)\ndate: 2025-11-29\ntags:\n    - attack.command-and-control\n    - attack.t1102.002\n    - attack.t1071\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_worker_img:  # Example command C:\\Users\\Lab\\actions-runner\\bin\\Runner.Worker.exe spawnclient 1288 1252\n        - Image|endswith: '\\Runner.Worker.exe'\n        - OriginalFileName: 'Runner.Worker.dll'\n    selection_worker_cli:\n        CommandLine|contains: 'spawnclient'\n    selection_listener_img: # Example command C:\\Users\\Lab\\actions-runner\\bin\\Runner.Listener.exe  configure --url https://github.com/ABC/ABC --token 123123\n        - Image|endswith: '\\Runner.Listener.exe'\n        - OriginalFileName: 'Runner.Listener.dll'\n    selection_listener_cli:\n        CommandLine|contains:\n            - 'run'\n            - 'configure'\n    condition: all of selection_worker_* or all of selection_listener_*\nfalsepositives:\n    - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure\n    - Authorized runner deployments by DevOps/Platform teams following change management\n    - Scheduled runner updates or reconfigurations on existing build agents\n    - Self-hosted runners that follow expected/known naming patterns\n    - Installation via expected/known configuration management tools (reflected mostly as parent process name)\nlevel: medium\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071","id":"T1071","name":"Application Layer Protocol","page":"techniques/enterprise/T1071/"},{"key":"enterprise/T1102.002","id":"T1102.002","name":"Bidirectional Communication","page":"techniques/enterprise/T1102.002/"}],"data_path":"data/detection-rules/5bac7a56-da88-4c27-922e-c81e113b20cb.json","kind":"sigma"}