Detection rules › Sigma

Github Self-Hosted Runner Execution

Severity
medium
Author
Daniel Koifman (KoifSec)
Source
upstream

Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1071 Application Layer Protocol, T1102.002 Web Service: Bidirectional Communication

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_worker_img

or:
Image|endswith: '\Runner.Worker.exe'
OriginalFileName: Runner.Worker.dll

Stage 2: all of selection_worker_cli

CommandLine|contains: spawnclient

Stage 3: all of selection_listener_img

or:
Image|endswith: '\Runner.Listener.exe'
OriginalFileName: Runner.Listener.dll

Stage 4: all of selection_listener_cli

or:
CommandLine|contains: configure
CommandLine|contains: run

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • configure
  • run
  • spawnclient
Imageends_with
  • \Runner.Listener.exe
  • \Runner.Worker.exe
OriginalFileNameeq
  • Runner.Listener.dll
  • Runner.Worker.dll