Sigma rule: Github Self-Hosted Runner Execution

Rule

Title

Github Self-Hosted Runner Execution

Status

test

Level

medium

Author

Daniel Koifman (KoifSec)

Date

2025-11-29

File

rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.
Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.

Log source

product

windows

category

process_creation

Detection

selection_worker_img:  # Example command C:\Users\Lab\actions-runner\bin\Runner.Worker.exe spawnclient 1288 1252
    - Image|endswith: '\Runner.Worker.exe'
    - OriginalFileName: 'Runner.Worker.dll'
selection_worker_cli:
    CommandLine|contains: 'spawnclient'
selection_listener_img: # Example command C:\Users\Lab\actions-runner\bin\Runner.Listener.exe  configure --url https://github.com/ABC/ABC --token 123123
    - Image|endswith: '\Runner.Listener.exe'
    - OriginalFileName: 'Runner.Listener.dll'
selection_listener_cli:
    CommandLine|contains:
        - 'run'
        - 'configure'
condition: all of selection_worker_* or all of selection_listener_*

False positives (as the rule lists them)

• Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure
• Authorized runner deployments by DevOps/Platform teams following change management
• Scheduled runner updates or reconfigurations on existing build agents
• Self-hosted runners that follow expected/known naming patterns
• Installation via expected/known configuration management tools (reflected mostly as parent process name)

Tags

• attack.command-and-control
• attack.t1102.002
• attack.t1071

MITRE ATT&CK ids this rule names

• T1071
• T1102.002

References

• https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
• https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml