CI-RUNNER-PERSISTPersistence

Runner Persistence (custom hook)

Drop ACTIONS_RUNNER_HOOK_JOB_STARTED on the runner — fires before every future job, grants persistent code-exec.

§ Where this technique fits

CI-RUNNER-PERSIST is catalogued under the Persistence tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

Self-hosted runner takeover → persistent CI compromise
A public repo with self-hosted GitHub runners accepts external PRs. First malicious PR runs on the runner; the workflow drops a runner-hook that fires before every future job.
step 4 / 6

§ What commonly comes next

01
Valid Accounts
T1078 · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Self-hosted runner takeover → persistent CI compromise

§ What commonly comes next