GitHub Audit Log Self-Hosted Runner Configuration Change Alerts

title: GitHub Audit Log Self-Hosted Runner Configuration Change Alerts
id: ef1d7694-a36d-409f-9215-89abca6e3790
status: test
description: This rule flags GitHub audit log events that indicate changes to self-hosted runner registrations and runner group configurations, including runner creation/removal and runner group updates or runner additions/removals. Such changes matter because attackers may attempt to register or modify runners to execute actions under their control, potentially enabling persistence or privilege-related impact. It relies on telemetry from GitHub audit log events that record the specific runner and runner group operations.
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2023-01-27
references:
  - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/github/audit/github_self_hosted_runner_changes_detected.yml
tags:
  - attack.impact
  - attack.discovery
  - attack.collection
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.stealth
  - attack.t1526
  - attack.t1213.003
  - attack.t1078.004
logsource:
  product: github
  service: audit
  definition: "Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming"
detection:
  selection:
    action:
      - org.remove_self_hosted_runner
      - org.runner_group_created
      - org.runner_group_removed
      - org.runner_group_runner_removed
      - org.runner_group_runners_added
      - org.runner_group_runners_updated
      - org.runner_group_updated
      - repo.register_self_hosted_runner
      - repo.remove_self_hosted_runner
  condition: selection
falsepositives:
  - Allowed self-hosted runners changes in the environment.
  - A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 14 days.
  - An ephemeral self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 1 day.
level: low
license: DRL-1.1
related:
  - id: f8ed0e8f-7438-4b79-85eb-f358ef2fbebd
    type: derived