Rule Info
Name
Github Self Hosted Runner Changes Detected
Author
Muhammad Faisal (@faisalusuf)
Description
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Date
2023-01-27 00:00:00
Modified
None
Id
f8ed0e8f-7438-4b79-85eb-f358ef2fbebd
Tags
attack.impact attack.discovery attack.collection attack.defense_evasion attack.persistence attack.privilege_escalation attack.initial_access attack.t1526 attack.t1213.003 attack.t1078.004 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4738 from @nasbench - Small fixes and metadata updates
2024-02-26
github-actions[bot]
Merge PR #4611 from @nasbench - Promote Older Rules Status From `experimental` To `test`
2023-12-01
Scan your endpoints, forensic images or collected files with our portable scanner THOR