Microsoft GitHub Repo Compromise: CI/CD Pipeline Attack and Defense

---
title: GitHub Actions Runner Spawning Encoded PowerShell
id: 8a4b2c1d-5e6f-4a3b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects GitHub Actions Runner processes spawning PowerShell with encoded commands, a common technique to obfuscate malware delivery in CI/CD attacks.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\Runner.Worker.exe'
      - '\Runner.Listener.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-EncodedCommand'
      - '-Enc'
      - 'FromBase64String'
  condition: selection
falsepositives:
  - Legitimate build scripts using encoded parameters (rare)
level: high
---
title: Git Process Connecting to Non-GitHub Endpoint
id: 9c5d3e2f-6a7b-4c5d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects git.exe or GitHub Runner processes initiating network connections to external endpoints other than GitHub, potentially indicating C2 beaconing or data exfiltration.
references:
  - https://attack.mitre.org/techniques/T1071/001
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      - '\git.exe'
      - '\git-remote-http.exe'
      - '\Runner.Worker.exe'
  filter_legit_github:
    DestinationHostname|endswith:
      - 'github.com'
      - 'githubusercontent.com'
      - 'azdo azure.com' # Internal Microsoft/Azure DevOps
  condition: selection and not filter_legit_github
falsepositives:
  - Legitimate custom git remotes or package manager feeds
level: medium

// Hunt for suspicious parent-child process relationships in CI/CD
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ ("Runner.Worker.exe", "Runner.Listener.exe", "git.exe", "bash", "sh")
| where ProcessCommandLine contains any ("curl", "wget", "powershell", "pwsh", "cmd", "python")
| where ProcessCommandLine contains any ("-EncodedCommand", "base64", "http://", "ftp://")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, InitiatingProcessCommandLine
| extend MD5 = hash(SHA256, tostring(ProcessCommandLine)) // Dedup similar commands

-- Hunt for suspicious processes spawned by GitHub Actions Runners
SELECT Pid, Name, Exe, CommandLine, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Username
FROM pslist()
WHERE Parent.Name =~ "Runner.Worker" 
   OR Parent.Name =~ "Runner.Listener"
   // Flag common interpreter execution often abused in pipelines
   AND Name IN ("powershell.exe", "cmd.exe", "python.exe", "python3.exe", "bash", "sh")
   // Look for suspicious arguments like encoded commands or network activity flags
   AND (CommandLine =~ "-Enc" OR CommandLine =~ "curl" OR CommandLine =~ "wget" OR CommandLine =~ "socket")

# Audit Script: Check for recent interactions with targeted Microsoft Orgs
Write-Host "[+] Auditing recent Git activity for potential supply chain exposure..."

# Define targeted organizations from the threat intel
$TargetOrgs = @("Azure", "Microsoft", "Azure-Samples", "MicrosoftDocs")

# Check common Git config locations for remotes
$GitConfigPaths = @(
    "$env:USERPROFILE\.gitconfig",
    (Get-ChildItem -Path "$env:USERPROFILE\source\repos" -Recurse -Filter "config" -ErrorAction SilentlyContinue -Depth 3).FullName
)

$FoundSuspectRepos = $false

foreach ($Path in $GitConfigPaths) {
    if (Test-Path $Path) {
        $Content = Get-Content $Path -Raw -ErrorAction SilentlyContinue
        if ($Content -match "url\s*=\s*.*github.com[:/](.*)") {
            $RepoPath = $Matches[1]
            foreach ($Org in $TargetOrgs) {
                if ($RepoPath -like "$Org*" -or $RepoPath -like "*$Org*") {
                    Write-Host "[!] SUSPICIOUS REPO FOUND: $Path" -ForegroundColor Red
                    Write-Host "    - Remote: $RepoPath" -ForegroundColor Yellow
                    $FoundSuspectRepos = $true
                }
            }
        }
    }
}

if (-not $FoundSuspectRepos) {
    Write-Host "[+] No remotes matching targeted organizations found in standard locations." -ForegroundColor Green
} else {
    Write-Host "[CRITICAL] Immediate review of the identified repositories is required. Verify commit history for unauthorized pushes." -ForegroundColor Red
}

# Check for running GitHub Runner processes
$RunnerProcesses = Get-Process | Where-Object { $_.ProcessName -like "*Runner*" -and $_.Company -like "GitHub*" }
if ($RunnerProcesses) {
    Write-Host "[+] Active GitHub Runner processes detected. Review running jobs for anomalies." -ForegroundColor Cyan
}