Execution via GitHub Actions Runner

  1[metadata]
  2creation_date = "2025/11/26"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule detects potentially dangerous commands spawned by the GitHub Actions Runner.Worker process or by shell
 11interpreters launched via a runner entrypoint script on self-hosted runner machines. Adversaries who gain the ability
 12to modify or trigger workflows in a linked GitHub repository can execute arbitrary commands on the runner host. This
 13behavior may indicate malicious or unexpected workflow activity, including code execution, reconnaissance, credential
 14harvesting, or network exfiltration initiated through a compromised repository or unauthorized workflow.
 15"""
 16false_positives = [
 17    "Authorized GitHub actions runner with no malicious workflow actions.",
 18]
 19from = "now-9m"
 20index = [
 21    "endgame-*",
 22    "logs-crowdstrike.fdr*",
 23    "logs-endpoint.events.process-*",
 24    "logs-m365_defender.event-*",
 25    "logs-sentinel_one_cloud_funnel.*",
 26    "logs-system.security*",
 27    "logs-windows.forwarded*",
 28    "logs-windows.sysmon_operational-*",
 29    "winlogbeat-*",
 30    "auditbeat-*",
 31    "logs-auditd_manager.auditd-*"
 32]
 33language = "eql"
 34license = "Elastic License v2"
 35name = "Execution via GitHub Actions Runner"
 36note = """## Triage and analysis
 37
 38### Investigating Execution via GitHub Actions Runner
 39
 40Adversaries who gain the ability to modify or trigger workflows in a linked GitHub repository can execute arbitrary
 41commands on the runner host. This rule covers two parent process paths:
 42- **Direct execution**: process spawned directly by `Runner.Worker` / `Runner.Worker.exe`.
 43- **Entrypoint script execution**: process spawned by a shell (`sh`, `bash`, `zsh`) whose command line references
 44  a runner `entrypoint.sh` script, a common pattern when the runner bootstraps workflow steps via a shell script.
 45
 46### Possible investigation steps
 47
 48- Review `process.command_line` and `process.parent.command_line` to determine whether the activity matches a known,
 49  authorized workflow step.
 50- For `grep`, `find`, `pgrep`, `printenv`, and `env` hits, assess whether the command targets sensitive paths, environment
 51  variables (e.g. secrets, tokens), or process listings inconsistent with the declared workflow.
 52- For `openssl` and `base64` hits, inspect arguments for encoding/decoding operations that may indicate credential
 53  harvesting, data staging, or a C2 channel.
 54- For `tr` and `cat` hits, assess whether they are chained with other suspicious commands (e.g. `cat /etc/passwd | base64`,
 55  `cat ~/.ssh/id_rsa`) to read and encode sensitive files for exfiltration.
 56- For `nc`, `ncat`, `netcat`, and `socat` hits, check arguments for reverse shell patterns or port-forwarding to
 57  attacker-controlled infrastructure.
 58- For `wg` and `wg-quick` hits, inspect arguments for tunnel configuration that may establish a covert egress channel.
 59- For `ssh` hits, review arguments for reverse tunnel flags (`-R`) or connections to unexpected remote hosts.
 60- For `kubectl` and `helm` hits, assess whether commands target sensitive namespaces, extract secrets, or deploy
 61  workloads inconsistent with the declared workflow.
 62- For `vault` hits, inspect arguments for secret reads (`vault kv get`) or token operations that may indicate
 63  credential harvesting from a HashiCorp Vault instance.
 64- For `gh` hits, review arguments for repository cloning, secret access (`gh secret`), or actions that escalate
 65  access via the runner's GitHub token.
 66- For `nmap` hits, assess whether the command performs host or port discovery against internal network ranges,
 67  indicating lateral movement preparation.
 68- Examine associated network activity for unexpected outbound connections, especially following `curl`, `wget`, or
 69  `openssl s_client` invocations.
 70- Verify whether the triggering workflow run was initiated by an authorized actor and matches the repository's
 71  expected workflow definitions.
 72- Correlate with file-write and file-access events to identify any sensitive file staging or collection activity.
 73- Correlate with other alerts to determine if this activity is part of a broader supply chain or CI/CD compromise.
 74
 75### False positive analysis
 76
 77- Authorized GitHub workflow actions that legitimately use discovery utilities (`find`, `grep`, `env`, `nmap`), data
 78  manipulation tools (`cat`, `tr`), encoding tools (`openssl`, `base64`), remote access tools (`ssh`), or
 79  infrastructure CLIs (`kubectl`, `helm`, `vault`, `gh`) as part of their build, test, or deploy steps may trigger
 80  this rule. Validate against known workflow definitions and consider adding workflow-specific exclusions if the
 81  volume is high.
 82
 83### Response and remediation
 84
 85- Immediately isolate the affected system from the network to prevent further unauthorized command execution and potential lateral movement.
 86- Terminate any suspicious child processes that were initiated by the Github actions runner.
 87- Conduct a thorough review of the affected system's logs and configurations to identify any unauthorized changes or additional indicators of compromise.
 88- Restore the system from a known good backup if any unauthorized changes or malicious activities are confirmed.
 89- Implement application whitelisting to prevent unauthorized execution.
 90- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on the broader network."""
 91references = [
 92    "https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
 93    "https://socket.dev/blog/shai-hulud-strikes-again-v2",
 94]
 95risk_score = 47
 96rule_id = "a640ef5b-e1da-4b17-8391-468fdbd1b517"
 97severity = "medium"
 98tags = [
 99    "Domain: Endpoint",
100    "OS: Linux",
101    "OS: Windows",
102    "OS: macOS",
103    "Use Case: Threat Detection",
104    "Tactic: Execution",
105    "Tactic: Initial Access",
106    "Data Source: Elastic Endgame",
107    "Data Source: Elastic Defend",
108    "Data Source: Windows Security Event Logs",
109    "Data Source: Microsoft Defender XDR",
110    "Data Source: Sysmon",
111    "Data Source: SentinelOne",
112    "Data Source: Crowdstrike",
113    "Data Source: Auditd Manager",
114    "Resources: Investigation Guide",
115    "Noise: High",
116    "Performance: Normal",
117    "Profile: Aggressive",
118    "Threat: Supply Chain",
119    "Threat: Living off the Land",
120    "Rule Type: Event Correlation (EQL)",
121    "Platform: Windows",
122    "Platform: Linux",
123    "Platform: macOS",
124]
125timestamp_override = "event.ingested"
126type = "eql"
127
128query = '''
129process where event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
130 (
131   /* Direct child of the GitHub Actions Runner.Worker process */
132   process.parent.name in ("Runner.Worker", "Runner.Worker.exe") or
133
134   /* Child of a shell interpreter launched via a runner entrypoint script
135      (e.g. /home/runner/runners/<ver>/run/entrypoint.sh or similar paths) */
136   (
137     process.parent.name in ("sh", "bash", "zsh") and
138     process.parent.command_line like "*runner*entrypoint.sh"
139   )
140 ) and
141 (
142   process.name : (
143     /* Network / download utilities */
144     "curl", "curl.exe", "wget", "wget.exe",
145     /* Windows scripting & LOLBins */
146     "powershell.exe", "cmd.exe", "pwsh.exe", "certutil.exe", "rundll32.exe",
147     /* Unix shells */
148     "bash", "sh", "zsh", "dash", "ash", "tcsh", "csh", "ksh", "fish", "mksh", "busybox", "pwsh",
149     /* File / archive manipulation */
150     "tar", "gzip", "rm", "sed", "chmod",
151     /* macOS-specific */
152     "osascript",
153     /* Process persistence helpers */
154     "nohup", "setsid",
155     /* Scripting runtimes */
156     "python*", "perl*", "ruby*", "lua*", "php*", "node", "nodejs", "node.exe",
157     /* Discovery & reconnaissance */
158     "pgrep", "grep", "find", "printenv", "env", "nmap",
159     /* Crypto / encoding (potential exfiltration or C2 channel) */
160     "openssl", "base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16", "xxd",
161     /* Data manipulation / inspection */
162     "tr", "cat",
163     /* Network relay / tunneling */
164     "nc", "ncat", "netcat", "nc.traditional", "nc.openbsd", "socat", "wg", "wg-quick",
165     /* Remote access */
166     "ssh", "ssh.exe", "ftp", "tftp", "scp", "sftp",
167     /* Kubernetes / infrastructure */
168     "kubectl", "helm", "docker", "ctr", "crictl",
169     /* Secret management */
170     "vault",
171     /* GitHub CLI */
172     "gh",
173     /* AWS CLI */
174     "aws",
175     /*Azure CLI */
176     "az",
177     /*GCP CLI */
178     "gcloud",
179     /* Google Workspace CLI */
180     "gws"
181   ) or
182   process.executable : ("/tmp/*", "/private/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "?:\\Users\\*")
183 )
184'''
185
186
187[[rule.threat]]
188framework = "MITRE ATT&CK"
189
190[[rule.threat.technique]]
191id = "T1059"
192name = "Command and Scripting Interpreter"
193reference = "https://attack.mitre.org/techniques/T1059/"
194
195[[rule.threat.technique.subtechnique]]
196id = "T1059.001"
197name = "PowerShell"
198reference = "https://attack.mitre.org/techniques/T1059/001/"
199
200[[rule.threat.technique.subtechnique]]
201id = "T1059.002"
202name = "AppleScript"
203reference = "https://attack.mitre.org/techniques/T1059/002/"
204
205[[rule.threat.technique.subtechnique]]
206id = "T1059.003"
207name = "Windows Command Shell"
208reference = "https://attack.mitre.org/techniques/T1059/003/"
209
210[[rule.threat.technique.subtechnique]]
211id = "T1059.004"
212name = "Unix Shell"
213reference = "https://attack.mitre.org/techniques/T1059/004/"
214
215[[rule.threat.technique.subtechnique]]
216id = "T1059.006"
217name = "Python"
218reference = "https://attack.mitre.org/techniques/T1059/006/"
219
220[[rule.threat.technique.subtechnique]]
221id = "T1059.007"
222name = "JavaScript"
223reference = "https://attack.mitre.org/techniques/T1059/007/"
224
225[rule.threat.tactic]
226id = "TA0002"
227name = "Execution"
228reference = "https://attack.mitre.org/tactics/TA0002/"
229
230[[rule.threat]]
231framework = "MITRE ATT&CK"
232
233[[rule.threat.technique]]
234id = "T1195"
235name = "Supply Chain Compromise"
236reference = "https://attack.mitre.org/techniques/T1195/"
237
238[[rule.threat.technique.subtechnique]]
239id = "T1195.002"
240name = "Compromise Software Supply Chain"
241reference = "https://attack.mitre.org/techniques/T1195/002/"
242
243[rule.threat.tactic]
244id = "TA0001"
245name = "Initial Access"
246reference = "https://attack.mitre.org/tactics/TA0001/"
247
248[[rule.threat]]
249framework = "MITRE ATT&CK"
250
251[[rule.threat.technique]]
252id = "T1218"
253name = "System Binary Proxy Execution"
254reference = "https://attack.mitre.org/techniques/T1218/"
255
256[[rule.threat.technique.subtechnique]]
257id = "T1218.011"
258name = "Rundll32"
259reference = "https://attack.mitre.org/techniques/T1218/011/"
260
261[rule.threat.tactic]
262id = "TA0005"
263name = "Defense Evasion"
264reference = "https://attack.mitre.org/tactics/TA0005/"