Github Self-Hosted Runner Execution

 1title: Github Self-Hosted Runner Execution
 2id: 5bac7a56-da88-4c27-922e-c81e113b20cb
 3status: test
 4description: |
 5    Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.
 6    Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
 7    It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.    
 8references:
 9    - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
10    - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
11author: Daniel Koifman (KoifSec)
12date: 2025-11-29
13tags:
14    - attack.command-and-control
15    - attack.t1102.002
16    - attack.t1071
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection_worker_img:  # Example command C:\Users\Lab\actions-runner\bin\Runner.Worker.exe spawnclient 1288 1252
22        - Image|endswith: '\Runner.Worker.exe'
23        - OriginalFileName: 'Runner.Worker.dll'
24    selection_worker_cli:
25        CommandLine|contains: 'spawnclient'
26    selection_listener_img: # Example command C:\Users\Lab\actions-runner\bin\Runner.Listener.exe  configure --url https://github.com/ABC/ABC --token 123123
27        - Image|endswith: '\Runner.Listener.exe'
28        - OriginalFileName: 'Runner.Listener.dll'
29    selection_listener_cli:
30        CommandLine|contains:
31            - 'run'
32            - 'configure'
33    condition: all of selection_worker_* or all of selection_listener_*
34falsepositives:
35    - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure
36    - Authorized runner deployments by DevOps/Platform teams following change management
37    - Scheduled runner updates or reconfigurations on existing build agents
38    - Self-hosted runners that follow expected/known naming patterns
39    - Installation via expected/known configuration management tools (reflected mostly as parent process name)
40level: medium
41regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml