GitRunner C2 - EID 4104 Script Block Captures GitLab CI C2 Job Variables

Ethan Andrews@eandrews

•updated Jun 30, 2026•0•0•2

Detects the abuse of GitLab Runner to establish a C2 channel via malicious PowerShell script blocks. The rule identifies anomalous combinations of GitLab CI environment variables (e.g., CI_PIPELINE_SOURCE=api, GIT_STRATEGY=none, CI_JOB_NAME=run_command) and the execution of arbitrary commands (IEX $env:CMD) within PowerShell script block logging (Event ID 4104).