Query: write Sigma for Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and
Matching passage: Sigma rule: Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and. Logsource: windows / process_creation. Rule: title: Github Self-Hosted Runner Execution id: 5bac7a56-da88-4c27-922e-c81e113b20cb status: test description: 'Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks. ' references: - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/ - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ author: Daniel Koifman (KoifSec) date: 2025-11-29 tags: - attack.command-and-control - attack.t1102.002 - attack.t1071 logsource: category: process_creation product: windows detection: selection_worker_img: - Image|endswith: \Runner.Worker.exe - OriginalFileName: Runner.Worker.dll selection_worker_cli: CommandLine|contains: spawnclient selection_listener_img: - Image|endswith: \Runner.Listener.exe - OriginalFileName: Runner.Listener.dll selection_listener_cli: CommandLine|contains: - run - configure condition: all of selection_worker_* or all of selection_listener_* falsepositives: - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure - Authorized runner deployments by DevOps/Platform teams following change management - Scheduled runner updates or reconfigurations on existing build agents - Self-hosted runners that follow expected/known naming patterns - Installation via expected/known configuration management tools (reflected mostly as parent process name) level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml
Near-miss passage: Sigma rule: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.. Logsource: macos / process_creation. Rule: title: Launch Agent/Daemon Execution Via Launchctl id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e status: test description: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html - https://www.loobins.io/binaries/launchctl/ author: Pratinav Chandra date: 2024-05-13 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1569.001 - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /launchctl CommandLine|contains: - submit - load - start condition: selection falsepositives: - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious. level: medium