Query: write Sigma for A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule
Matching passage: Sigma rule: A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule. Logsource: github / audit. Rule: title: Github Self Hosted Runner Changes Detected id: f8ed0e8f-7438-4b79-85eb-f358ef2fbebd status: test description: 'A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-27 references: - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation tags: - attack.impact - attack.discovery - attack.collection - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1526 - attack.t1213.003 - attack.t1078.004 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - org.remove_self_hosted_runner - org.runner_group_created - org.runner_group_removed - org.runner_group_runner_removed - org.runner_group_runners_added - org.runner_group_runners_updated - org.runner_group_updated - repo.register_self_hosted_runner - repo.remove_self_hosted_runner condition: selection falsepositives: - Allowed self-hosted runners changes in the environment. - A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 14 days. - An ephemeral self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 1 day. level: low
Near-miss passage: Sigma rule: This events that are generated when using the hacktool Ruler by Sensepost. Logsource: windows / security. Rule: title: Hacktool Ruler id: 24549159-ac1b-479c-8175-d42aea947cae status: test description: This events that are generated when using the hacktool Ruler by Sensepost references: - https://github.com/sensepost/ruler - https://github.com/sensepost/ruler/issues/47 - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624 author: Florian Roth (Nextron Systems) date: 2017-05-31 modified: 2022-10-09 tags: - attack.discovery - attack.execution - attack.collection - attack.lateral-movement - attack.t1087 - attack.t1114 - attack.t1059 - attack.t1550.002 logsource: product: windows service: security detection: selection1: EventID: 4776 Workstation: RULER selection2: EventID: - 4624 - 4625 WorkstationName: RULER condition: (1 of selection*) falsepositives: - Go utilities that use staaldraad awesome NTLM library level: high