Skip to content

Commit a32358e

Browse files
committed
Update initial_access_github_register_self_hosted_runner.toml
1 parent a6779f9 commit a32358e

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

rules/integrations/github/initial_access_github_register_self_hosted_runner.toml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ from = "now-9m"
1717
index = ["logs-github.audit-*"]
1818
language = "kuery"
1919
license = "Elastic License v2"
20-
name = "First Time Seen GitHub Self Hosted Action Runner"
20+
name = "New GitHub Self Hosted Action Runner"
2121
note = """## Triage and analysis
2222
23-
### Investigating First Time Seen GitHub Self Hosted Runner
23+
### Investigating New GitHub Self Hosted Action Runner
2424
2525
Adversaries who gain the ability to modify or trigger workflows in a linked GitHub repository can execute arbitrary commands on the runner host.
2626

0 commit comments

Comments
 (0)