Browse Rules

GitHub Cross-Fork Workflow Run

Tracks workflows run in cross-fork pull requests.

GitHub Workflow Downloading Artifacts

Detects when a GitHub Actions workflow downloads artifacts.

Jira - Workflow scheme copied

'Detects when workflow scheme was copied.'

GitHub Workflow Using Self-Hosted Runner

Detects when a GitHub Actions workflow runs on a self-hosted runner.

Box Content Workflow Policy Violation

A user violated the content workflow policy.

GitHub Workflow Contains Checkout Action

Detects when a GitHub Actions workflow job contains a checkout step. The checkout action (actions/checkout) pulls repository code into the workflow runner. In certain contexts, especially with pull_request_target triggers or workflows with elevated permissions, checking out untrusted code can pose security risks. This detection helps identify workflows that interact with repository code for security review.

GitHub Workflow File Creation or Modification

The following analytic hunts for any creations or modifications to GitHub Actions workflow YAML files across the organization's Linux or Windows endpoints. This hunting query tracks all workflow file activity under .github/workflows directories to help defenders establish baselines of legitimate CI/CD workflow creation patterns, identify unusual or unauthorized changes, and detect anomalies that may indicate supply chain compromise. GitHub Actions workflows execute with privileged access to secr

Microsoft Workflow Compiler Execution

Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.

Microsoft Workflow Compiler Execution

Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.

Microsoft Workflow Compiler Execution

Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.

GitHub Commits Skipping Workflows

Detects commits from cross-fork scenarios that contain workflow skip directives, which bypass GitHub Actions workflows. These skip patterns ([skip ci], [ci skip], [no ci], [skip actions], [actions skip], skip-checks:true) can be used to avoid security checks and CI/CD processes. This rule only alerts on commits to public forkable repositories.

GitHub Workflow Permissions Modified

Detects when the default workflow permissions for the GITHUB_TOKEN are modified at the organization level. GitHub Actions workflows use GITHUB_TOKEN for authentication, and changing these permissions can either expand or restrict what workflows can do by default. Unauthorized modifications could allow attackers to escalate privileges in CI/CD pipelines, potentially leading to supply chain compromise through malicious workflow modifications, unauthorized code deployments, or exfiltration of secre

GitHub Workflow Dispatched by GitHub Actions Bot

Detects when a GitHub App server-to-server token (GITHUB_TOKEN) triggers a workflow manually through the workflow_dispatch event, creating a new workflow run. This activity may indicate that a possibly previously exfiltrated GITHUB_TOKEN was subsequently used to authenticate to the GitHub REST API to trigger a workflow manually. This technique has been observed as the last step in the attack chain of the Nx/S1ngularity supply chain attack.

Suspicious Automator Workflows Execution

Identifies the execution of the Automator Workflows process followed by a network connection from the XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript.

microsoft_workflow_compiler

Detects invocation of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code. License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.

GitHub pull_request_target Workflow Usage

Detects usage of pull_request_target workflows, which run with elevated privileges and can access secrets even when triggered by external contributors from forks. These workflows pose security risks as they run in the context of the target repository rather than the fork, potentially allowing malicious code execution with write access and secrets. Low severity for non-cross-fork PRs.

Shai-Hulud Malicious GitHub Workflow Creation

Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets

GitHub pull_request_target Workflow on Self-Hosted Runner

Detects when a pull_request_target workflow runs on a self-hosted runner. pull_request_target workflows run with elevated privileges and have access to repository secrets even when triggered by external contributors from forks. When these workflows run on self-hosted runners attackers can gain direct code execution on the underlying infrastructure with potential access to internal network, databases, and systems. Unlike GitHub-hosted runners which are destroyed after each job, self-hosted runn

Shai-Hulud Workflow File Creation or Modification

Detects creation or deletion of malicious GitHub Actions workflow files associated with Shai-Hulud worm variants on Linux or Windows endpoints. This includes the original shai-hulud-workflow.yml, the 2.0 backdoor discussion.yaml (enables command injection via GitHub Discussions on self-hosted runners named SHA1HULUD), and the secrets exfiltration workflow formatter_*.yml pattern. These files are used to exfiltrate credentials and propagate across repositories.

GitHub Actions Workflow Modification Blocked

Detects when a GitHub Actions workflow attempts to create or modify workflow files in a protected branch but is blocked due to insufficient permissions. This behavior is indicative of a supply chain attack where a malicious package or compromised CI/CD pipeline attempts to inject persistent backdoor workflows into a repository.

GitHub Artifact Download from Cross-Fork Workflow

The "download artifacts" API, and various custom actions encapsulating it, doesn't differentiate between artifacts that were uploaded by forked repositories and base repositories, which could lead privileged workflows to download artifacts that were created by forked repositories and that are potentially poisoned.

Suspicious Curl Execution via Automator Workflow

Detects Automator spawning shell interpreters to execute curl with file output arguments within 10 seconds. This indicates abuse of trusted Automator workflows for malicious file downloads.

GitHub pull_request_target Workflow with Checkout Action

Detects when a pull_request_target workflow contains a checkout action, creating a potential security risk. pull_request_target workflows run with elevated privileges and have access to repository secrets even when triggered by external contributors from forks. When combined with a checkout action, this can create dangerous attack vectors. This is a well-known technique for supply chain compromise in GitHub Actions, often called a "pwn request".

Suspicious Automator Workflows Execution

Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript.

Service abuse: Oracle Cloud Workflow callback scam

Detects inbound messages sent through Oracle Cloud's workflow mail service (workflow.mail.us2.cloud.oracle.com) that contain callback scam content within styled HTML table cells. Natural language understanding is used to identify callback scam intent with medium or high confidence within the message body, indicating misuse of legitimate Oracle infrastructure to deliver fraudulent content.