GitLab Runner Spawning Child Processes with Build Directory Working Path

Ethan Andrews@eandrews

•updated Jun 30, 2026•0•0•3

Detects processes spawned by the GitLab Runner binary (gitlab-runner-windows-amd64.exe) where the working directory is set to the GitLab CI/CD build folder (C:\GitLab-Runner\builds\). This activity is indicative of automated job execution which, when occurring on non-developer or unauthorized hosts, may represent command dispatch by an attacker using a rogue or compromised runner for C2 operations.