Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener

Alerts on Windows process activity from GitHub self-hosted runner Worker/Listener indicating spawnclient or run/configure operations.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Daniel Koifman (KoifSec) (SigmaHQ), DRL 1.1
Published: 2025-11-29
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071Application Layer Protocol
- T1102.002Bidirectional Communication
Exfiltration
Impact

What it detects

This rule identifies Windows process executions associated with GitHub self-hosted runners by matching the Runner.Worker.exe spawnclient activity or the Runner.Listener.exe configure and run activity. Such runner processes can enable persistence and code execution within local infrastructure because they are designed to interact with CI workflows and, in many environments, access internal resources and secrets. It relies on process creation telemetry, specifically the process image name endings, OriginalFileName values, and command-line content.

Reporting behind it

Related detections9 linkedT1071 — drag to rearrange

Suspicious SSH Service on Non Standard Port 57722

Suspicious Project CAV3RN logAzure.txt Configuration Drop (via file_event)

Suspicious Bash Reverse Shell via /dev/tcp

Windows Network Connections to azurefd.net Excluding Common Browsers and Known Front Door Hostnames

macOS Installer Scripts Spawning Suspicious Interpreter Child Processes

Windows DNS analytic events for GALLIUM-related ddns QNAMEs (EventID 257)

Windows Process Creation alerts on GALLIUM-associated hash IOCs

Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)

Suspicious Telegram API proxy access without Telegram User-Agent

Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener

Pivot detection · T1071 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-github-self-hosted-runner-worker-listener-spawn-and-con-5bac7a56

title: Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener
id: 1b90110e-8aa2-4dac-93d3-4d0eb96b2f24
status: test
description: This rule identifies Windows process executions associated with GitHub self-hosted runners by matching the Runner.Worker.exe spawnclient activity or the Runner.Listener.exe configure and run activity. Such runner processes can enable persistence and code execution within local infrastructure because they are designed to interact with CI workflows and, in many environments, access internal resources and secrets. It relies on process creation telemetry, specifically the process image name endings, OriginalFileName values, and command-line content.
references:
  - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
  - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-11-29
tags:
  - attack.command-and-control
  - attack.t1102.002
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection_worker_img:
    - Image|endswith: \Runner.Worker.exe
    - OriginalFileName: Runner.Worker.dll
  selection_worker_cli:
    CommandLine|contains: spawnclient
  selection_listener_img:
    - Image|endswith: \Runner.Listener.exe
    - OriginalFileName: Runner.Listener.dll
  selection_listener_cli:
    CommandLine|contains:
      - run
      - configure
  condition: all of selection_worker_* or all of selection_listener_*
falsepositives:
  - Legitimate GitHub self-hosted runner installations on designated CI/CD infrastructure
  - Authorized runner deployments by DevOps/Platform teams following change management
  - Scheduled runner updates or reconfigurations on existing build agents
  - Self-hosted runners that follow expected/known naming patterns
  - Installation via expected/known configuration management tools (reflected mostly as parent process name)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_github_self_hosted_runner/info.yml
license: DRL-1.1
related:
  - id: 5bac7a56-da88-4c27-922e-c81e113b20cb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL