Query: rule covering Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and
Matching passage: Sigma rule: Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and. Logsource: windows / process_creation. Rule: title: Github Self-Hosted Runner Execution id: 5bac7a56-da88-4c27-922e-c81e113b20cb status: test description: 'Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks. ' references: - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/ - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ author: Daniel Koifman (KoifSec) date: 2025-11-29 tags: - attack.command-and-control - attack.t1102.002 - attack.t1071 logsource: category: process_creation product: windows detection: selection_worker_img: - Image|endswith: \Runner.Worker.exe - OriginalFileName: Runner.Worker.dll selection_worker_cli: CommandLine|contains: spawnclient selection_listener_img: - Image|endswith: \Runner.Listener.exe - OriginalFileName: Runner.Listener.dll selection_listener_cli: CommandLine|contains: - run - configure condition: all of selection_worker_* or all of selection_listener_* falsepositives: - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure - Authorized runner deployments by DevOps/Platform teams following change management - Scheduled runner updates or reconfigurations on existing build agents - Self-hosted runners that follow expected/known naming patterns - Installation via expected/known configuration management tools (reflected mostly as parent process name) level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml
Near-miss passage: Sigma rule: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution. Logsource: windows / system. Rule: title: Important Windows Eventlog Cleared id: 100ef69e-3327-481c-8e5c-6d80d9507556 related: - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b type: derived status: test description: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2022-05-17 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: system detection: selection: EventID: 104 Provider_Name: Microsoft-Windows-Eventlog Channel: - Microsoft-Windows-PowerShell/Operational - Microsoft-Windows-Sysmon/Operational - PowerShellCore/Operational - Security - System - Windows PowerShell condition: selection falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: high