GitHub Copilot Autofix Introduced a GitHub Actions Flaw That Exposed Snowflake's Internal Jira — CI/CD Defense Guide

---
title: GitHub Actions Workflow Modified by Bot or AI Assistant
id: 3f9a1c7e-2b4d-4e8a-9c1f-5a6b7d8e9f01
status: experimental
description: Detects creation or modification of GitHub Actions workflow files by bot accounts or AI assistants (e.g., Copilot Autofix, dependabot, github-actions bot). These changes bypass normal human code review patterns and can introduce pipeline vulnerabilities.
references:
  - https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.supply_chain_compromise
  - attack.t1195.002
logsource:
  product: github
  service: audit
detection:
  selection_action:
    action:
      - 'workflows.created_workflow'
      - 'workflows.updated_workflow'
      - 'protected_branch.update_required_status_checks'
      - 'repo.actions_enabled'
  selection_actor:
    actor|contains:
      - 'copilot'
      - 'autofix'
      - 'bot'
      - 'dependabot'
  condition: selection_action or (selection_actor and action|contains: 'workflow')
falsepositives:
  - Legitimate Dependabot workflow updates (still warrants review of diff)
  - Automation bots managed by platform engineering
level: high
---
title: GitHub Actions Workflow Job Approved or Queued on Self-Hosted Runner for External PR
id: 8b2e4d61-7c3a-4f5b-a2d8-1e9f0a3b5c72
status: experimental
description: Detects workflow jobs queued or approved for self-hosted runners, which grants PR-triggered code execution on hosts with internal network access. Key stage in the Wiz Red Agent pivot to internal Jira.
references:
  - https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  product: github
  service: audit
detection:
  selection:
    action:
      - 'workflows.approve_workflow_job'
      - 'workflows.prepare_workflow_job'
      - 'workflows.queued_workflow_job'
  condition: selection
falsepositives:
  - Normal CI operations — baseline by repository and runner group, alert on deviations (new repo, external actor, non-standard runner label)
level: medium
---
title: GitHub Actions Runner Spawning Suspicious Child Processes
id: c47d2a19-5e6f-4a8b-b3c9-2d1e4f6a8b03
status: experimental
description: Detects the GitHub Actions runner process spawning shells, credential access, or network tooling indicative of pipeline compromise. On self-hosted runners this can precede lateral movement into internal systems such as Jira.
references:
  - https://www.wiz.io/blog/red-agent-snowflake-copilot-cicd-bug
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.credential_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Runner.Worker.exe'
      - '\Runner.Listener.exe'
  selection_suspicious:
    CommandLine|contains:
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'Set-MpPreference'
      - 'lsass'
      - 'sekurlsa'
      - '/token'
      - 'vault'
      - 'metadata.google.internal'
      - '169.254.169.254'
  condition: selection_parent and selection_suspicious
falsepositives:
  - Build steps legitimately calling cloud metadata for OIDC — tune per-pipeline
level: high

// Hunt 1: Workflow file changes and privileged Actions events by non-human actors
let bots = dynamic(["copilot", "autofix", "dependabot", "github-actions", "bot"]);
GitHubAuditLog_CL
| where TimeGenerated > ago(14d)
| where Action_s has_any ("workflows.created_workflow", "workflows.updated_workflow",
                          "workflows.approve_workflow_job", "repo.actions_enabled",
                          "repo.actions_secret")
| extend ActorLower = tolower(Actor_s)
| where ActorLower has_any (bots)
   or Action_s has "approve_workflow_job"
   or Action_s has "actions_secret"
| project TimeGenerated, Actor_s, Action_s, Repo_s, Repository_s, OperationType_s, AdditionalFields_s
| order by TimeGenerated desc;

// Hunt 2: Self-hosted runner spawning credential or network tooling (Defender for Endpoint)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("Runner.Worker.exe", "Runner.Listener.exe", "run.sh", "Runner.Worker")
   or InitiatingProcessCommandLine has_any ("actions-runner", "_work")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "curl.exe", "curl", "wget", "whoami.exe", "id")
   or ProcessCommandLine has_any ("169.254.169.254", "metadata", "token", "secret", "env", "IEX", "DownloadString")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ReportId
| order by TimeGenerated desc;

// Hunt 3: Runner hosts making unusual SaaS/API egress (pivot toward Jira-like internal targets)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessCommandLine has_any ("Runner.Worker", "actions-runner")
| where RemoteUrl has_any ("jira", "atlassian", "confluence", "slack.com", "vault", "okta")
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by DeviceName, RemoteUrl, RemoteIP
| order by Connections asc; // rare destinations from CI runners are the tell

-- Hunt GitHub Actions runner hosts for suspicious child processes and workflow modifications
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(runner\.worker|actions-runner|_work)'
   OR Exe =~ '(?i)(actions-runner|Runner\.Worker)'

LET suspicious_children = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)Runner\.(Worker|Listener)|run\.sh|RunnerService')
  AND CommandLine =~ '(?i)(169\.254\.169\.254|metadata|token|secret|curl|wget|iex|downloadstring|/etc/passwd|id$|whoami|env)'

LET workflow_files = SELECT FullPath, Mtime, Size
FROM glob(globs='C:\actions-runner\**\.github\workflows\*.yml',
          accessor='file')
WHERE Mtime > now() - 604800

SELECT 'runner_process' AS Category, Pid, Ppid, Name, CommandLine, Username, CreateTime, '' AS FullPath, NULL AS Mtime FROM procs
UNION ALL
SELECT 'suspicious_child' AS Category, Pid, Ppid, Name, CommandLine, Username, CreateTime, '' AS FullPath, NULL AS Mtime FROM suspicious_children
UNION ALL
SELECT 'modified_workflow' AS Category, NULL, NULL, '', '', '', NULL, FullPath, Mtime FROM workflow_files

#!/usr/bin/env bash
# github-actions-audit.sh — surface risky workflow patterns introduced by AI/bot commits
set -euo pipefail
ORG="${1:?Usage: $0 <github-org>}"

echo "=== [1] Repos with Copilot Autofix / code scanning autofix enabled ==="
gh api "orgs/$ORG/repos" --paginate -q '.[].full_name' | while read -r repo; do
  autofix=$(gh api "repos/$repo" -q '.security_and_analysis.secret_scanning.status // "n/a"' 2>/dev/null || echo "unknown")
  echo "$repo  security_and_analysis=$autofix"
done

echo ""
echo "=== [2] Dangerous workflow patterns across org ==="
gh api "orgs/$ORG/repos" --paginate -q '.[].full_name' | while read -r repo; do
  gh api "repos/$repo/contents/.github/workflows" -q '.[].download_url' 2>/dev/null | while read -r url; do
    content=$(curl -fsSL "$url" 2>/dev/null || continue)
    echo "$content" | grep -qE 'pull_request_target|issue_comment' && \
      echo "[RISKY TRIGGER] $repo -> $url"
    echo "$content" | grep -qE 'permissions:\s*$' && \
      echo "$content" | grep -A6 'permissions:' | grep -qE 'contents:\s*write|actions:\s*write|id-token:\s*write' && \
      echo "[WRITE TOKEN] $repo -> $url"
    echo "$content" | grep -E '\$\{\{[^}]*github\.event\.(issue|comment|pull_request)\.(title|body|head\.ref)[^}]*\}\}' | grep -q 'run:' && \
      echo "[SCRIPT INJECTION] $repo -> $url"
    echo "$content" | grep -qE 'runs-on:.*self-hosted' && \
      echo "[SELF-HOSTED] $repo -> $url"
  done
done

echo ""
echo "=== [3] Workflow-file commits authored by bots/AI in the last 90 days ==="
gh api "orgs/$ORG/repos" --paginate -q '.[].full_name' | while read -r repo; do
  gh api "repos/$repo/commits?path=.github/workflows&since=$(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
    -q '.[] | select(.author.login != null) | [.author.login, .commit.author.date, .sha[0:8], (.commit.message | split("\n")[0])] | @tsv' \
    2>/dev/null | grep -iE 'copilot|autofix|\[bot\]|dependabot' | sed "s/^/$repo  /"
done

echo ""
echo "=== [4] Missing CODEOWNERS protection on .github/ ==="
gh api "orgs/$ORG/repos" --paginate -q '.[].full_name' | while read -r repo; do
  if ! gh api "repos/$repo/contents/CODEOWNERS" >/dev/null 2>&1 && \
     ! gh api "repos/$repo/contents/.github/CODEOWNERS" >/dev/null 2>&1; then
    echo "[NO CODEOWNERS] $repo"
  fi
done

echo ""
echo "=== [5] Org default workflow permissions (want: read) ==="
gh api "orgs/$ORG/actions/permissions/workflow" -q '{default: .default_workflow_permissions, can_approve: .can_approve_pull_request_reviews}'