Elastic Defend high stable eql

Discovery of GitHub Actions Runner Process PID

This rule detects the discovery of the GitHub Actions Runner process PID using the pgrep command. Adversaries may use this technique to identify the PID of the GitHub Actions Runner process, which can be used to execute commands on the runner host. This behavior may indicate malicious or unexpected workflow activity, including code execution, file manipulation, or network exfiltration initiated through a compromised repository or unauthorized workflow.

View Source

Detection Logic

sequence by process.parent.entity_id with maxspan=3s
  [process where event.type == "start" and event.action == "exec" and process.name == "pgrep" and
  process.args in ("Runner.Listener", "Runner.Worker", "Runner.PluginHost", "run.sh", "svc.sh", "runsvc.sh")] as event0
  [process where event.type == "start" and event.action == "exec" and process.name == "pgrep" and
  not startswith~(process.command_line, event0.process.command_line) and
  process.args in ("Runner.Listener", "Runner.Worker", "Runner.PluginHost", "run.sh", "svc.sh", "runsvc.sh")]

Field Validations

Loading…

Comments (0)

Loading comments...