Harden-Runner
Named by 38 kept items in this workspace.
27 items name it under tools, 7 under classification.technologies and 4 under classification.key entities.
Search every workspace for Harden-Runner. It matches the name as written, so it can find other things that share it.
The items that name it 38
Supplies runtime data in which indicators of compromise are observed for the Threat Center Affecting You view.
provides network and process visibility during CI/CD runs, correlates outbound connections to repository/workflow/step, blocks connections to a global block list (now including 193.32.204.199) by default, and supports an enforced allowed-endpoints allowlist policy and network telemetry review
third-party agent monitoring and filtering runner egress
Provides network and process visibility during CI/CD runs; blocks connections to identified C2 domains by default and supports enforced allowed-endpoints policies.
Provides runtime telemetry (egress monitoring/firewall) used by StepSecurity's Advisor to observe runtime behaviour of actions across organisations; can run in audit mode (records egress without blocking) or enforcing mode.
Egress control for GitHub Actions workflows; version v2.21.0 adds a denied-endpoints input for deny-list egress policies (egress-policy: block) alongside existing allow-list support.
GitHub Actions runner security tool (StepSecurity) that monitors outbound network calls, file writes, and process executions on the runner, correlating them to the workflow step that caused them; provides runtime detection (e.g., memory-read technique behind CVE-2025-8217) with a triage runbook; sup
Blocks credential-dumping/exfiltration attacks via egress policy on GitHub Actions runners; detected Sha1-Hulud worm inside CNCF's Backstage repo and captured the axios RAT's live C2 callback.
StepSecurity's runtime security agent for CI/CD runners; blocks unauthorized outbound network connections (block mode), terminates jobs when malware attempts to read secrets from process memory (lockdown mode), and in audit mode baselines normal network/process behavior per workflow to flag anomalie
Monitors a CI job's actual outbound network calls (network baseline) and can enforce a network egress policy to block traffic to public package registries
Runtime security monitor for CI on GitHub Actions, GitLab, and self-hosted runners; baselines every outbound network call and process, and in block mode stops exfiltration to destinations not on the allowlist. Also used internally by StepSecurity to detonate malicious packages in ephemeral, credenti
Secret exfiltration protection that flags workflow runs attempting to dump secrets as they execute
analyzes each workflow run as its webhook arrives to detect malicious indicators such as secret dumping
GitHub Actions runner security tool providing egress monitoring and enforcement (audit mode and block mode) to prevent secret exfiltration; v2.20.0 adds block mode support for macOS and Windows GitHub-hosted runners; protects 13,000+ open-source projects and enterprises
Monitors outbound network calls from GitHub Actions workflow runs and, in block mode, only allows traffic to explicitly allowed endpoints, surfacing anomalous exfiltration attempts at runtime; run by 13,000+ open-source projects and enterprises.
GitHub Actions network and process monitoring; captured the dropped binary's outbound connections and can block anomalous process/network patterns like a preinstall hook spawning a detached process, under an allowed-endpoints policy
StepSecurity's runtime security tool for GitHub Actions runners; free for public repositories, detected the tj-actions/changed-files compromise, trusted by over 15,000 open-source projects and enterprises including Microsoft, Google, and CISA
Purpose-built security agent for CI/CD runners; monitors network events, process executions, file access, and outbound connections at the step level in GitHub Actions; detects anomalous process chains (e.g., node-gyp spawning curl, unzip, bun) and unauthorized memory reads, and initiates lockdown mo
StepSecurity tool referenced as having detected Shai-Hulud in CNCF's Backstage repository (per linked article)
StepSecurity tool that monitors GitHub Actions, GitLab CI, and Azure DevOps pipeline steps at runtime, detecting unexpected network egress, unauthorized process spawning, and anomalous package manager activity.
Legitimate defensive tooling that is targeted/blocked by the malware
StepSecurity's runtime security tool used to observe and analyze the durabletask attack in a GitHub Actions workflow; in default deployment automatically blocks outbound calls to malicious C2 domains like check.git-service.com
runtime security tool for CI/CD; page compares the free version of Harden-Runner against cicd-sensor
Purpose-built security agent for CI/CD runners; enforces network egress allowlist, DNS and network-level enforcement, Global Block List for known C2 domains, and detects Runner Worker memory reads (secret scraping), terminating workflows on detection.
Restricts runner network egress to an allowlist on GitHub-hosted runners.
Runtime security agent for GitHub Actions runners; monitors process behavior and enforces network egress policies to detect/block credential exfiltration (block mode drops connections to non-allowlisted domains; audit mode flags anomalies). Free for open-source repositories.
Security agent for CI/CD runners that enforces a network egress allowlist (DNS and network-level) in GitHub Actions, blocking and alerting on outbound connections to disallowed domains/IPs such as sh.azurestaticprovider.net and anomalous DNS TXT exfiltration
All technologies in this workspace.