✄𐘗
text code block:
✄𐘗process where event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
 (
   /* Direct child of the GitHub Actions Runner.Worker process */
   process.parent.name in ("Runner.Worker", "Runner.Worker.exe") or

   /* Child of a shell interpreter launched via a runner entrypoint script
      (e.g. /home/runner/runners/<ver>/run/entrypoint.sh or similar paths) */
   (
     process.parent.name in ("sh", "bash", "zsh") and
     process.parent.command_line like "*runner*entrypoint.sh"
   )
 ) and
 (
   process.name : (
     /* Network / download utilities */
     "curl", "curl.exe", "wget", "wget.exe",
     /* Windows scripting & LOLBins */
     "powershell.exe", "cmd.exe", "pwsh.exe", "certutil.exe", "rundll32.exe",
     /* Unix shells */
     "bash", "sh", "zsh", "dash", "ash", "tcsh", "csh", "ksh", "fish", "mksh", "busybox", "pwsh",
     /* File / archive manipulation */
     "tar", "gzip", "rm", "sed", "chmod",
     /* macOS-specific */
     "osascript",
     /* Process persistence helpers */
     "nohup", "setsid",
     /* Scripting runtimes */
     "python*", "perl*", "ruby*", "lua*", "php*", "node", "nodejs", "node.exe",
     /* Discovery & reconnaissance */
     "pgrep", "grep", "find", "printenv", "env", "nmap",
     /* Crypto / encoding (potential exfiltration or C2 channel) */
     "openssl", "base64", "basez", "base64plain", "base64url", "base64mime", "base64pem", "basenc", "base32", "base16", "xxd",
     /* Data manipulation / inspection */
     "tr", "cat",
     /* Network relay / tunneling */
     "nc", "ncat", "netcat", "nc.traditional", "nc.openbsd", "socat", "wg", "wg-quick",
     /* Remote access */
     "ssh", "ssh.exe", "ftp", "tftp", "scp", "sftp",
     /* Kubernetes / infrastructure */
     "kubectl", "helm", "docker", "ctr", "crictl",
     /* Secret management */
     "vault",
     /* GitHub CLI */
     "gh",
     /* AWS CLI */
     "aws",
     /*Azure CLI */
     "az",
     /*GCP CLI */
     "gcloud",
     /* Google Workspace CLI */
     "gws"
   ) or
   process.executable : ("/tmp/*", "/private/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "?:\\Users\\*")
 ) and
not (
  /* Runner orchestration layer. Runner.Worker writes every `run:` step to <work>/_work/_temp/<guid>.<ext>
     and launches the configured shell on it (bash/sh/pwsh/powershell/cmd/python built-ins all use the
     same template), and runs JavaScript actions as node <work>/_work/_actions/<owner>/<repo>/<ref>/...
     The exclusion is anchored on the runner `_work/_temp` and `_work/_actions` directories so that
     admin-configured job-extension hook scripts on an arbitrary path that merely contains `_temp` are
     NOT suppressed. docker and tar are intentionally NOT excluded, because an attacker-controlled
     workflow can invoke them directly to stage, archive, or execute payloads. */
  process.parent.name in ("Runner.Worker", "Runner.Worker.exe") and
  (
    (process.name : ("bash", "sh", "dash", "cmd.exe", "python", "python3", "python.exe") and
     process.args : ("*/_work/_temp/*", "*\\_work\\_temp\\*")) or
    (process.name : ("pwsh", "pwsh.exe", "powershell.exe") and
     process.args : ("*/_work/_temp/*.ps1*", "*\\_work\\_temp\\*.ps1*")) or
    (process.name : ("node", "node.exe") and
     process.args : ("*/_work/_actions/*", "*\\_work\\_actions\\*"))
  ) and
  not process.executable : ("/tmp/*", "/private/tmp/*", "/var/tmp/*", "/dev/shm/*")
)