Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener
Alerts on Windows process activity from GitHub self-hosted runner Worker/Listener indicating spawnclient or run/configure operations.
- Product
- windows
- Category
- process_creation
- Author
- Daniel Koifman (KoifSec) (SigmaHQ), DRL 1.1
- Published
- 2025-11-29
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Windows process executions associated with GitHub self-hosted runners by matching the Runner.Worker.exe spawnclient activity or the Runner.Listener.exe configure and run activity. Such runner processes can enable persistence and code execution within local infrastructure because they are designed to interact with CI workflows and, in many environments, access internal resources and secrets. It relies on process creation telemetry, specifically the process image name endings, OriginalFileName values, and command-line content.
Reporting behind it
- about.gitlab.comhttps://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
- securitylabs.datadoghq.comhttps://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener
id: 1b90110e-8aa2-4dac-93d3-4d0eb96b2f24
status: test
description: This rule identifies Windows process executions associated with GitHub self-hosted runners by matching the Runner.Worker.exe spawnclient activity or the Runner.Listener.exe configure and run activity. Such runner processes can enable persistence and code execution within local infrastructure because they are designed to interact with CI workflows and, in many environments, access internal resources and secrets. It relies on process creation telemetry, specifically the process image name endings, OriginalFileName values, and command-line content.
references:
- https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
- https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-11-29
tags:
- attack.command-and-control
- attack.t1102.002
- attack.t1071
logsource:
category: process_creation
product: windows
detection:
selection_worker_img:
- Image|endswith: \Runner.Worker.exe
- OriginalFileName: Runner.Worker.dll
selection_worker_cli:
CommandLine|contains: spawnclient
selection_listener_img:
- Image|endswith: \Runner.Listener.exe
- OriginalFileName: Runner.Listener.dll
selection_listener_cli:
CommandLine|contains:
- run
- configure
condition: all of selection_worker_* or all of selection_listener_*
falsepositives:
- Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure
- Authorized runner deployments by DevOps/Platform teams following change management
- Scheduled runner updates or reconfigurations on existing build agents
- Self-hosted runners that follow expected/known naming patterns
- Installation via expected/known configuration management tools (reflected mostly as parent process name)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml
license: DRL-1.1
related:
- id: 5bac7a56-da88-4c27-922e-c81e113b20cb
type: derived