Elastic Open-Sources CI/CD Abuse Detector Using Regex Signals and Claude Analysis
Summary
Elastic Security Labs open-sourced cicd-abuse-detector, a CI template combining 50+ regex and metadata signals with Claude analysis to flag suspicious workflow changes across GitHub Actions, GitLab CI, and Azure DevOps.
Key points
- The detector scans changed CI/CD-related files for 50+ regex and metadata signals, then sends the signals and full diff to Claude for a structured threat assessment.
- It supports GitHub Actions, GitLab CI, and Azure DevOps, diffing files individually with a 10,000-character cap.
- Verdicts include severity, confidence, reasoning, evidence, and recommendations; configured workflows can alert, create issues, or fail a pull request, and optionally send records to Elasticsearch.
- Elastic says its detection patterns were tested against offensive tools and incidents including Nord Stream, ArtiPACKED, HackerBot-Claw, and Shai-Hulud; the project includes 19 malicious and four benign example diffs and an automated test suite.
- The article identifies risks including secret harvesting, privileged pull_request_target workflows, broad token permissions, mutable action references, and backdated commits.
- Recommended defenses include pinning actions to commit SHAs, limiting secret and token permissions, avoiding unsafe use of pull_request_target, and disabling persisted checkout credentials when appropriate.
Article Details
- Defense Focus
- Detect suspicious CI/CD workflow changes at the pull request or protected-branch stage, before they can be used to steal secrets or compromise software delivery.
- Detection Methods
- Scan per-file diffs with more than 50 regex and metadata signals for risky workflow changes, including secret interpolation, privileged pull_request_target triggers, untrusted pull request checkouts, double-base64 encoding, LD_PRELOAD, and automatic VS Code tasks.
- Use Claude to assess the signal summary and full diff alongside author profile and commit metadata, including temporal analysis for backdated commits.
- Correlate verdicts across GitHub Actions, GitLab CI, and Azure DevOps in Elasticsearch using ES|QL.
- Data Sources
- Changed CI/CD-relevant files and per-file diffs from pull requests or pushes to protected branches
- Author profile and commit metadata
- CI/CD platform, repository, actor, event type, and run URL metadata
- Structured detector verdicts, including severity, confidence, reasoning, and evidence
- Rule Types
- Regex-based signal patterns
- Structured JSON verdicts validated against a JSON Schema
- ES|QL correlation queries
- Platforms
- GitHub Actions
- GitLab CI
- Azure DevOps
- Elasticsearch
- Slack
- GitHub Issues
- Defensive Actions
- Pin CI actions to specific SHAs rather than tags or branches.
- Scope secrets to individual steps and use short-lived, ephemeral tokens where possible.
- Avoid pull_request_target unless necessary; do not check out pull request head code in the same workflow when using it.
- Set explicit, minimal permissions for each workflow and job.
- Set persist-credentials: false on checkout and account for token exposure when uploading artifacts.
- Configure alerts and PR checks to respond to verdict severity, and optionally index verdicts in Elasticsearch for cross-platform correlation.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe article gives shell command examples used to extract and encode CI secrets or execute remote payloads, including curl | bash.T1070.006 · TimestompThe article describes backdating commits to make malicious workflow changes appear older and more trusted.T1195 · Supply Chain CompromiseThe article describes supply chain manipulation through mutable action references, dependency poisoning, lockfile registry swaps, and remote script execution.T1552 · Unsecured CredentialsThe article describes attackers harvesting CI secrets using modified workflows, including credentials exposed through .git/config in uploaded artifacts.
CVE
Malware
Vendors
Products
Azure DevOps(Claude) analysis to detect suspicious CI/CD workflow changes across GitHub Actions, GitLab CI, and Azure DevOps.ClaudeLabs open-sourced cicd-abuse-detector, a drop-in CI template that uses 50+ regex signals plus LLM (Claude) analysis to detect suspicious CI/CD workflow changes across GitHub Actions, GitLab CI, and Azure DevOps.ElasticsearchHackerBot-Claw, GhostAction, Shai-Hulud) and produces structured JSON verdicts with optional Elasticsearch logging for cross-platform correlation.GitHub Actionsuses 50+ regex signals plus LLM (Claude) analysis to detect suspicious CI/CD workflow changes across GitHub Actions, GitLab CI, and Azure DevOps.GitLab CIsignals plus LLM (Claude) analysis to detect suspicious CI/CD workflow changes across GitHub Actions, GitLab CI, and Azure DevOps.
Tools
cicd-abuse-detectorElastic Security Labs open-sourced cicd-abuse-detector, a drop-in CI template that uses 50+ regex signals plus LLM (Claude) analysis to detect suspicious CI/CD workflow changes across GitHub Actions, GitLab CI, andClaude Code CLINo Python, no dependencies beyond bash and the Claude Code CLIGato-XDetection patterns were tested against offensive tooling and real incidents (Nord Stream, Gato-X, ArtiPACKED, HackerBot-Claw, GhostAction, Shai-Hulud) and ship with 19 malicious and 4 benign example diffs plus anNord StreamThe project is validated against real incidents and offensive toolkits (e.g., Nord Stream, ArtiPACKED, HackerBot-Claw, GhostAction, Shai-Hulud) and produces structured JSON verdicts with optional Elasticsearch loggingTruffleHogThis self-propagating attack harvested GitHub Personal Access Tokens via gh auth token, ran TruffleHog for secret reconnaissance, and used compromised tokens to silently inject malicious code into other packages owned