Remote GitHub Actions Runner Registration

  1[metadata]
  2creation_date = "2025/11/26"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule detects the configuration of a GitHub Actions self-hosted runner using the Runner.Listener binary.
 11When a machine is registered to a remote repository, its owner gains the ability to execute arbitrary workflow commands on that host.
 12Unexpected or unauthorized runner registration may indicate adversarial activity aimed at establishing remote code execution
 13via malicious GitHub workflows.
 14"""
 15false_positives = [
 16    "Authorized github repository with no malicious workflow actions.",
 17]
 18from = "now-9m"
 19index = [
 20    "endgame-*",
 21    "logs-crowdstrike.fdr*",
 22    "logs-endpoint.events.process-*",
 23    "logs-m365_defender.event-*",
 24    "logs-sentinel_one_cloud_funnel.*",
 25    "logs-system.security*",
 26    "logs-windows.forwarded*",
 27    "logs-windows.sysmon_operational-*",
 28    "winlogbeat-*",
 29    "auditbeat-*",
 30    "logs-auditd_manager.auditd-*"
 31]
 32language = "eql"
 33license = "Elastic License v2"
 34name = "Remote GitHub Actions Runner Registration"
 35note = """## Triage and analysis
 36
 37### Investigating Remote GitHub Actions Runner Registration
 38
 39Unexpected or unauthorized Github actions runner registration may indicate adversarial activity aimed at establishing remote code execution via malicious GitHub workflows.
 40
 41### Possible investigation steps
 42
 43- Review the remote repository details and reputation.
 44- Examine the remote repository for any suspicious workflows run commands in the `.github/workflows` folder.
 45- Examine the execution context like process tree, associated network and file activities.
 46- Verify if there is adjascent any sensitive file access or collection.
 47- Correlate with other alerts and investiguate if this activity is related to a supply chain attack.
 48
 49### False positive analysis
 50
 51- Authorized configuration changes.
 52
 53### Response and remediation
 54
 55- Immediately isolate the affected system from the network to prevent further unauthorized command execution and potential lateral movement.
 56- Terminate any suspicious child processes that were initiated by the registered Github actions runner.
 57- Conduct a thorough review of the affected system's logs and configurations to identify any unauthorized changes or additional indicators of compromise.
 58- Restore the system from a known good backup if any unauthorized changes or malicious activities are confirmed.
 59- Implement application whitelisting to prevent unauthorized execution.
 60- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on the broader network."""
 61references = [
 62    "https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
 63    "https://socket.dev/blog/shai-hulud-strikes-again-v2",
 64]
 65risk_score = 47
 66rule_id = "57e118c1-19eb-4c20-93a6-8a6c30a5b48b"
 67severity = "medium"
 68tags = [
 69    "Domain: Endpoint",
 70    "OS: Linux",
 71    "OS: Windows",
 72    "OS: macOS",
 73    "Use Case: Threat Detection",
 74    "Tactic: Execution",
 75    "Tactic: Initial Access",
 76    "Data Source: Elastic Endgame",
 77    "Data Source: Elastic Defend",
 78    "Data Source: Windows Security Event Logs",
 79    "Data Source: Microsoft Defender XDR",
 80    "Data Source: Sysmon",
 81    "Data Source: SentinelOne",
 82    "Data Source: Crowdstrike",
 83    "Data Source: Auditd Manager",
 84    "Resources: Investigation Guide",
 85    "Noise: Low",
 86    "Performance: Normal",
 87    "Profile: Recommended",
 88    "Threat: Supply Chain",
 89    "Rule Type: Event Correlation (EQL)",
 90    "Platform: Windows",
 91    "Platform: Linux",
 92    "Platform: macOS",
 93]
 94timestamp_override = "event.ingested"
 95type = "eql"
 96
 97query = '''
 98process where event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
 99 process.name in ("Runner.Listener", "Runner.Listener.exe") and
100 process.args == "configure" and process.args == "--url" and process.args == "--token"
101'''
102
103
104[[rule.threat]]
105framework = "MITRE ATT&CK"
106
107[[rule.threat.technique]]
108id = "T1059"
109name = "Command and Scripting Interpreter"
110reference = "https://attack.mitre.org/techniques/T1059/"
111
112[rule.threat.tactic]
113id = "TA0002"
114name = "Execution"
115reference = "https://attack.mitre.org/tactics/TA0002/"
116
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119
120[[rule.threat.technique]]
121id = "T1195"
122name = "Supply Chain Compromise"
123reference = "https://attack.mitre.org/techniques/T1195/"
124
125[[rule.threat.technique.subtechnique]]
126id = "T1195.002"
127name = "Compromise Software Supply Chain"
128reference = "https://attack.mitre.org/techniques/T1195/002/"
129
130[rule.threat.tactic]
131id = "TA0001"
132name = "Initial Access"
133reference = "https://attack.mitre.org/tactics/TA0001/"
134
135[[rule.threat]]
136framework = "MITRE ATT&CK"
137
138[[rule.threat.technique]]
139id = "T1219"
140name = "Remote Access Tools"
141reference = "https://attack.mitre.org/techniques/T1219/"
142
143[rule.threat.tactic]
144id = "TA0011"
145name = "Command and Control"
146reference = "https://attack.mitre.org/tactics/TA0011/"