Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener

Alerts on Windows process activity from GitHub self-hosted runner Worker/Listener indicating spawnclient or run/configure operations.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Daniel Koifman (KoifSec) (SigmaHQ), DRL 1.1
Published: 2025-11-29
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071Application Layer Protocol
- T1102.002Bidirectional Communication
Exfiltration
Impact

What it detects

This rule identifies Windows process executions associated with GitHub self-hosted runners by matching the Runner.Worker.exe spawnclient activity or the Runner.Listener.exe configure and run activity. Such runner processes can enable persistence and code execution within local infrastructure because they are designed to interact with CI workflows and, in many environments, access internal resources and secrets. It relies on process creation telemetry, specifically the process image name endings, OriginalFileName values, and command-line content.

Reporting behind it

Related detections9 linkedT1102.002 — drag to rearrange

Suspicious Python Process Establishing PostgreSQL Command and Control Channel

Malicious Dropbox Cloud C2 via Spoofed Googlebot User Agent

Suspicious UNC1549 Azure C2 Beacon to News Notifications URI Pattern (via proxy)

Suspicious Project CAV3RN AzureCommunication.dll Load (via image_load)

Suspicious Google API DNS Query From Temporary Directory Process Abused for C2

Possible WailingCrab MQTT C2 to Public Broker (via network_connection)

Malicious OilRig OAuth Application Sign-In via Azure (via azure)

Suspicious Outbound Network Connection from explorer.exe

Suspicious Instant Messenger Client Spawning Script Interpreter (via process_creation)

Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener

Pivot detection · T1102.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-github-self-hosted-runner-worker-listener-spawn-and-con-5bac7a56

title: Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener
id: 1b90110e-8aa2-4dac-93d3-4d0eb96b2f24
status: test
description: This rule identifies Windows process executions associated with GitHub self-hosted runners by matching the Runner.Worker.exe spawnclient activity or the Runner.Listener.exe configure and run activity. Such runner processes can enable persistence and code execution within local infrastructure because they are designed to interact with CI workflows and, in many environments, access internal resources and secrets. It relies on process creation telemetry, specifically the process image name endings, OriginalFileName values, and command-line content.
references:
  - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
  - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-11-29
tags:
  - attack.command-and-control
  - attack.t1102.002
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection_worker_img:
    - Image|endswith: \Runner.Worker.exe
    - OriginalFileName: Runner.Worker.dll
  selection_worker_cli:
    CommandLine|contains: spawnclient
  selection_listener_img:
    - Image|endswith: \Runner.Listener.exe
    - OriginalFileName: Runner.Listener.dll
  selection_listener_cli:
    CommandLine|contains:
      - run
      - configure
  condition: all of selection_worker_* or all of selection_listener_*
falsepositives:
  - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure
  - Authorized runner deployments by DevOps/Platform teams following change management
  - Scheduled runner updates or reconfigurations on existing build agents
  - Self-hosted runners that follow expected/known naming patterns
  - Installation via expected/known configuration management tools (reflected mostly as parent process name)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml
license: DRL-1.1
related:
  - id: 5bac7a56-da88-4c27-922e-c81e113b20cb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL