GitHub Actions Runner - CraftedSignal Threat Feed

Detection of Unauthorized GitHub Actions Runner Registration

hello@craftedsignal.io — Tue, 30 Jan 2024 12:00:00 +0000

This threat brief focuses on the malicious registration of GitHub Actions self-hosted runners. The attack involves adversaries registering a machine as a runner to a remote GitHub repository. Once registered, the attacker gains the ability to execute arbitrary workflow commands on the host. This can lead to supply chain compromise, remote code execution, and potentially lateral movement within a network. The rule detects the execution of Runner.Listener or Runner.Listener.exe with the configure, --url, and --token arguments, which are indicative of runner registration. This activity is particularly concerning as it provides a persistent remote access mechanism that bypasses traditional security controls.

Attack Chain

Attacker gains initial access to a system via various methods (e.g., compromised credentials, phishing, exploiting vulnerabilities).
Attacker downloads the GitHub Actions Runner software to the compromised host.
Attacker executes Runner.Listener or Runner.Listener.exe with the configure argument.
The attacker provides the --url argument, pointing to a malicious or attacker-controlled GitHub repository.
The attacker provides the --token argument, authenticating the runner against the malicious repository.
The compromised system registers as a self-hosted runner within the attacker's GitHub repository.
The attacker creates or modifies workflows in the GitHub repository to execute arbitrary commands on the registered runner.
The attacker triggers the malicious workflow, leading to command execution on the compromised host, potentially enabling data exfiltration, lateral movement, or the deployment of malware.

Impact

Successful exploitation allows attackers to execute arbitrary code on the registered runner machine. This can lead to data exfiltration, installation of malware, or use of the compromised system as a pivot point for further lateral movement within the network. The compromise can also lead to supply chain attacks if the runner has access to sensitive build processes or deployment pipelines. The scope of impact depends on the privileges of the account running the GitHub Actions Runner and the resources accessible from that host.

Recommendation

Deploy the Sigma rule "Remote GitHub Actions Runner Registration" to detect the execution of Runner.Listener with suspicious arguments (logsource: process_creation).
Investigate any alerts triggered by the Sigma rule "Remote GitHub Actions Runner Registration", focusing on the associated network and file activities.
Implement application whitelisting to prevent unauthorized execution of binaries like Runner.Listener and Runner.Listener.exe (logsource: process_creation).
Review GitHub repository details for any suspicious workflows or run commands, particularly in the .github/workflows folder (reference: https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise).

Execution via GitHub Actions Runner

hello@craftedsignal.io — Tue, 09 Jan 2024 14:30:00 +0000

Attackers can exploit self-hosted GitHub Actions runners by gaining the ability to modify or trigger workflows in a linked GitHub repository. This allows the execution of arbitrary commands on the runner host, potentially leading to malicious or unexpected workflow activity. This includes unauthorized code execution, file manipulation, and network exfiltration, all initiated through a compromised repository. The attacks observed leverage a variety of scripting languages and tools, including curl, wget, PowerShell, and others, to achieve their objectives, which necessitates comprehensive monitoring across different platforms. The incident observed aligns with supply chain compromise attack vectors.

Attack Chain

An attacker gains control of a GitHub repository linked to a self-hosted Actions runner, potentially through compromised credentials or a vulnerable dependency.
The attacker modifies a workflow file (.yml) in the repository to include malicious commands, such as downloading and executing a reverse shell.
The compromised workflow is triggered, either manually or by a scheduled event, causing the GitHub Actions Runner to execute the attacker's malicious code.
The Runner.Worker process spawns a command interpreter (e.g., powershell.exe, bash) to execute the attacker-controlled commands embedded in the workflow.
The attacker utilizes tools like curl or wget to download additional payloads or scripts from external sources to the runner machine.
Using certutil.exe the attacker downloads and decodes additional payloads.
The attacker establishes persistence by adding a scheduled task or modifying registry keys using commands executed via the GitHub Actions runner.
The attacker exfiltrates sensitive data from the runner host to an external server using tools like curl or powershell.

Impact

Successful exploitation allows attackers to execute arbitrary code on the self-hosted runner machine. This can lead to the compromise of sensitive data stored on the runner, such as credentials or API keys. Attackers can also use the compromised runner as a pivot point to gain access to other internal systems. Observed attacks have focused on supply chain compromises with an unknown number of victims. The impact can range from data breaches and financial loss to reputational damage.

Recommendation

Deploy the Sigma rule "Execution via GitHub Actions Runner - Suspicious Tools" to detect the execution of common attacker tools spawned by the GitHub Actions runner (rule: Execution via GitHub Actions Runner - Suspicious Tools).
Monitor process execution logs for child processes of Runner.Worker or Runner.Worker.exe that execute suspicious commands (log source: process_creation).
Implement application whitelisting to prevent unauthorized execution of binaries on the self-hosted runner machines (general hardening guidance).
Review and audit GitHub workflow configurations for any unauthorized or suspicious modifications (GitHub audit logs).