garnet-labs/posthog

Kernel-recorded by the Garnet eBPF sensorpinned to commit 14b5962 (merge ref)

probe — IMDS recordability/probe

run 311306000902026-08-06 23:22:57 UTC

Network Egress

8 destinations · 8 flows · 5 processes

recorded without an execution chain:no_bad_egress_domain

systemd
- hosted-compute-agent[1821 · hosted-compute-agent]runner infrastructure
  - Runner.Listener
    - Runner.Worker
      - bash
        curl[2338 · curl]step: 1. curl the metadata endpoint and a public endpoint
        example.com104.20.23.154:443 (https) · tcp
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)
        node
        node[2350 · node]step: 2. node child process performs the same requests
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)
        169.254.169.254:80 (http) · tcp(instance metadata)(detection: exec_from_unusual_dir)(detection: net_suspicious_tool_exec)
        example.com172.66.147.243:443 (https) · tcp(detection: exec_from_unusual_dir)
        curl[2336 · curl]step: 1. curl the metadata endpoint and a public endpoint
        169.254.169.254:80 (http) · tcp(instance metadata)(detection: exec_from_unusual_dir)(detection: net_suspicious_tool_exec)
      - node[2300 · node]runner infrastructure
        localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)
        api.github.com140.82.112.5:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
        github.com140.82.114.4:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
        release-assets.githubusercontent.com185.199.109.133:443 (https) · tcp(detection: credentials_files_access)(detection: interpreter_shell_spawn)
  - localhost127.0.0.53:53 (dns) · udp(dns resolver)(detection: credentials_files_access)(detection: exec_from_unusual_dir)(detection: interpreter_shell_spawn)
  - 140.82.112.4:443 (https) · tcp

Assertions

1 hit

ATTENTIONno_bad_egress_domain

Workload

Repositorygarnet-labs/posthog

Workflowprobe — IMDS recordability

Jobprobe

Run ID31130600090

Profile UUID019fd963-14f5-71df-8b37-e598603e0575

Commit SHA14b59628484283f8c8b4209f2fa23b85a62f05af(merge ref)

Refrefs/pull/84/merge

Timestamp2026-08-06 23:22:57 UTC

💡 How to read this

Runner.Worker
- bash
  - curl
    - example.com
    - localhost(dns resolver)