Suspicious Execution of Github Self-Hosted Runner (via process_creation)

title: Suspicious Execution of Github Self-Hosted Runner (via process_creation)
id: 2b66d65c-b761-5b5c-8dbf-74590c422454
status: stable
description: This rule detects GitHub self-hosted runners running workflows on local infrastructure that could be misused for persistence and code execution. Shai-Hulud is a npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, abusing their access to secrets and internal networks.
references:
    - https://attack.mitre.org/techniques/T1071/
    - https://attack.mitre.org/techniques/T1102/002/
    - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
    - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
author: Huntrule Team
date: 2026-06-02
tags:
    - attack.command-and-control
    - attack.t1102.002
    - attack.t1071
logsource:
    category: process_creation
    product: windows
detection:
    selection_worker_img:
        - Image|endswith: '\Runner.Worker.exe'
        - OriginalFileName: 'Runner.Worker.dll'
    selection_worker_cli:
        CommandLine|contains: 'spawnclient'
    selection_listener_img:
        - Image|endswith: '\Runner.Listener.exe'
        - OriginalFileName: 'Runner.Listener.dll'
    selection_listener_cli:
        CommandLine|contains:
            - 'run'
            - 'configure'
    condition: all of selection_worker_* or all of selection_listener_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml