Hide Navigation Hide TOC

Github Self Hosted Runner Changes Detected (f8ed0e8f-7438-4b79-85eb-f358ef2fbebd)

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Github Self Hosted Runner Changes Detected (f8ed0e8f-7438-4b79-85eb-f358ef2fbebd)	Sigma-Rules	Cloud Accounts - T1078.004 (f232fa7a-025c-4d43-abc7-318e81a73d65)	Attack Pattern	1
Github Self Hosted Runner Changes Detected (f8ed0e8f-7438-4b79-85eb-f358ef2fbebd)	Sigma-Rules	Code Repositories - T1213.003 (cff94884-3b1c-4987-a70b-6d5643c621c3)	Attack Pattern	1
Github Self Hosted Runner Changes Detected (f8ed0e8f-7438-4b79-85eb-f358ef2fbebd)	Sigma-Rules	Cloud Service Discovery - T1526 (e24fcba8-2557-4442-a139-1ee2f2e784db)	Attack Pattern	1
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	Cloud Accounts - T1078.004 (f232fa7a-025c-4d43-abc7-318e81a73d65)	Attack Pattern	2
Data from Information Repositories - T1213 (d28ef391-8ed4-45dc-bc4a-2f43abf54416)	Attack Pattern	Code Repositories - T1213.003 (cff94884-3b1c-4987-a70b-6d5643c621c3)	Attack Pattern	2