Wiz AI Agent Finds Critical Snowflake GitHub Actions Flaw That Advanced Security Missed: CI/CD Defense Guide

# VULNERABLE PATTERN — do not use in production
- name: Check PR title
  run: echo "Processing ${{ github.event.pull_request.title }}"

- name: Check PR title
  env:
    PR_TITLE: ${{ github.event.pull_request.title }}
  run: echo "Processing $PR_TITLE"

---
title: GitHub Actions Workflow File Modified with Dangerous Trigger or Injection Pattern
id: 3f8a1c42-7b9e-4d51-a6c2-9e1f5b8d3a07
status: experimental
description: Detects commits or file changes introducing pull_request_target triggers or untrusted context interpolation into GitHub Actions workflow files, a pattern associated with CI/CD script injection and supply-chain compromise as seen in the Snowflake workflow flaw disclosed by Wiz.
references:
  - https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/
  - https://attack.mitre.org/techniques/T1195/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.t1078
logsource:
  product: github
  service: audit
detection:
  selection_path:
    name|contains: '.github/workflows'
  selection_content:
    - 'pull_request_target'
    - '${{ github.event.issue.'
    - '${{ github.event.pull_request.title'
    - '${{ github.event.pull_request.body'
    - '${{ github.head_ref'
    - '${{ github.event.comment.body'
  condition: selection_path and selection_content
falsepositives:
  - Legitimate workflow updates by developers — validate against change tickets and require peer review for workflow changes
level: high
---
title: Suspicious Child Process Spawned by GitHub Actions Self-Hosted Runner
id: 8c2e5d19-4a6f-4b83-91d4-2c7a9e0f6b35
status: experimental
description: Detects self-hosted GitHub Actions runner worker processes spawning shells, download cradles, or cloud metadata clients, consistent with post-exploitation of a compromised workflow (e.g., after script injection in a vulnerable workflow file).
references:
  - https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1552.005/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.credential_access
  - attack.t1552.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Runner.Worker.exe'
      - '\Runner.Listener.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'iex'
      - 'DownloadString'
      - '169.254.169.254'
      - '-enc '
      - 'FromBase64String'
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Build steps legitimately invoking package downloads — baseline per repository and alert on deviation
level: high
---
title: Linux Runner Executing Cloud Metadata or Secret Access Commands
id: 5d1b7f03-9c48-4e62-b7a1-6f3d8a2c4e90
status: experimental
description: Detects Linux-based GitHub Actions runner processes accessing cloud instance metadata endpoints or dumping environment variables, indicating CI secret harvesting following workflow injection.
references:
  - https://www.infosecurity-magazine.com/news/wiz-ai-agent-finds-snowflake/
  - https://attack.mitre.org/techniques/T1552.005/
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.005
  - attack.t1528
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - '169.254.169.254'
      - 'metadata.google.internal'
      - 'printenv'
      - '/proc/self/environ'
      - 'env |'
      - 'AWS_SESSION_TOKEN'
      - 'ACTIONS_ID_TOKEN_REQUEST'
  filter_known_benign:
    CommandLine|contains:
      - 'az login --identity'
      - 'aws sts get-caller-identity'
  condition: selection_cmd and not filter_known_benign
falsepositives:
  - Legitimate OIDC federation steps in hardened workflows — these should be enumerated and allowlisted explicitly
level: high

// Hunt 1: Workflow file changes introducing dangerous triggers or injection sinks
// Requires GitHub audit log streaming to Sentinel (GitHubAuditLog / CommonSecurityLog via connector)
GitHubAuditLog
| where TimeGenerated > ago(14d)
| where Action in ("workflows.created_workflow", "workflows.updated_workflow",
                   "repo.actions_secret_accessed", "pull_request_target.enabled")
   or (Action == "git.push" and FilePaths has ".github/workflows")
| extend DangerPattern = iff(FileContent has_any ("pull_request_target",
        "github.event.pull_request.title", "github.head_ref",
        "github.event.issue.title", "github.event.comment.body"), true, false)
| where DangerPattern == true or Action startswith "workflows."
| project TimeGenerated, Actor, Repository, Action, FilePaths, DangerPattern, IPAddress
| sort by TimeGenerated desc;

// Hunt 2: Suspicious child processes under self-hosted runner workers (MDE telemetry)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("Runner.Worker.exe", "Runner.Listener.exe", "run.sh", "Runner.Worker")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget",
                      "bash", "sh", "certutil.exe", "python", "python3")
| where ProcessCommandLine has_any ("169.254.169.254", "metadata.google.internal",
        "DownloadString", "FromBase64String", "printenv", "/proc/self/environ",
        "ACTIONS_ID_TOKEN_REQUEST", "AWS_SESSION_TOKEN", "-enc ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated desc;

-- Hunt self-hosted GitHub Actions runner hosts for post-injection behavior
-- Targets: runner-spawned shells, metadata access, env harvesting, recent workflow file edits

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '169\\.254\\.169\\.254|metadata\\.google\\.internal|printenv|/proc/.*/environ|ACTIONS_ID_TOKEN_REQUEST|AWS_SESSION_TOKEN|DownloadString|FromBase64String'
   OR (Name =~ '(?i)runner\\.worker|run\\.sh' AND CommandLine =~ '(?i)bash|sh -c|powershell|pwsh')

LET workflows = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='**/actions-runner/_work/*/.github/workflows/*.y*ml')
WHERE Mtime > now() - 1209600  -- modified in last 14 days

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'WORKFLOW_FILE' AS Name, FullPath AS CommandLine,
       NULL AS Exe, NULL AS Username, Mtime AS CreateTime
FROM workflows

#!/bin/bash
# audit-gha-workflows.sh — Scan all org repos for dangerous GitHub Actions patterns
# Requires: gh CLI authenticated with repo + workflow scope, jq installed
set -euo pipefail

ORG="YOUR_ORG_NAME"
REPORT="gha_audit_$(date +%Y%m%d).csv"
echo "repo,workflow,issue" > "$REPORT"

for repo in $(gh repo list "$ORG" --limit 1000 --json nameWithOwner -q '.[].nameWithOwner'); do
  # List workflow files in default branch
  workflows=$(gh api "repos/$repo/contents/.github/workflows" --jq '.[].path' 2>/dev/null || true)
  [ -z "$workflows" ] && continue

  for wf in $workflows; do
    content=$(gh api "repos/$repo/contents/$wf" --jq '.content' | base64 -d)

    echo "$content" | grep -q "pull_request_target" && \
      echo "$repo,$wf,USES_pull_request_target" >> "$REPORT"

    echo "$content" | grep -qE '\$\{\{[[:space:]]*github\.(event\.(pull_request\.(title|body)|issue\.(title|body)|comment\.body)|head_ref)' && \
      echo "$repo,$wf,UNTRUSTED_CONTEXT_IN_RUN_STEP (injection risk)" >> "$REPORT"

    echo "$content" | grep -q "pull_request_target" && \
    echo "$content" | grep -qE 'ref:[[:space:]]*\$\{\{.*head' && \
      echo "$repo,$wf,CRITICAL_pull_request_target_WITH_FORK_CHECKOUT" >> "$REPORT"

    grep -q "permissions:" <<< "$content" || \
      echo "$repo,$wf,NO_EXPLICIT_PERMISSIONS_BLOCK" >> "$REPORT"

    echo "$content" | grep -q "id-token: write" && \
    echo "$content" | grep -qE 'pull_request' && \
      echo "$repo,$wf,OIDC_TOKEN_ON_PR_TRIGGER" >> "$REPORT"
  done
done

echo "[+] Audit complete. Findings in $REPORT"
awk -F, 'NR>1 {print $3}' "$REPORT" | sort | uniq -c | sort -rn