Windows Process Creation: GitHub Self-Hosted Runner Worker/Listener Spawn and Configure Activity

title: "Windows Process Creation: GitHub Self-Hosted Runner Worker/Listener Spawn and Configure Activity"
id: 1b90110e-8aa2-4dac-93d3-4d0eb96b2f24
status: test
description: This rule flags Windows process executions associated with GitHub self-hosted runner components, matching the Runner.Worker.exe spawnclient behavior or Runner.Listener.exe run/configure activity. Such executions matter because self-hosted runners provide a foothold for CI/CD abuse, including persistence and potential code execution within internal network and secret-access contexts. It relies on process creation telemetry, specifically image filename endings, OriginalFileName values, and command-line substrings indicating spawnclient, run, and configure.
references:
  - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
  - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-11-29
tags:
  - attack.command-and-control
  - attack.t1102.002
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection_worker_img:
    - Image|endswith: \Runner.Worker.exe
    - OriginalFileName: Runner.Worker.dll
  selection_worker_cli:
    CommandLine|contains: spawnclient
  selection_listener_img:
    - Image|endswith: \Runner.Listener.exe
    - OriginalFileName: Runner.Listener.dll
  selection_listener_cli:
    CommandLine|contains:
      - run
      - configure
  condition: all of selection_worker_* or all of selection_listener_*
falsepositives:
  - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure
  - Authorized runner deployments by DevOps/Platform teams following change management
  - Scheduled runner updates or reconfigurations on existing build agents
  - Self-hosted runners that follow expected/known naming patterns
  - Installation via expected/known configuration management tools (reflected mostly as parent process name)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml
license: DRL-1.1
related:
  - id: 5bac7a56-da88-4c27-922e-c81e113b20cb
    type: derived