Sigma rule: Shai-Hulud Malware Indicators - Linux
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-faa8e7de1213, updated 2025-11-25T00:00:00.000Z.
Rule
- Title
- Shai-Hulud Malware Indicators - Linux
- Status
- experimental
- Level
- high
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems)
- Date
- 2025-11-25
- File
- rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_indicator.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Log source
- product
- linux
- category
- process_creation
Detection
selection:
CommandLine|contains:
- 'Shai-Hulud'
- 'SHA1HULUD'
condition: selectionFalse positives (as the rule lists them)
- Legitimate software containing similar strings
Tags
- attack.execution
- attack.t1059
- detection.emerging-threats
MITRE ATT&CK ids this rule names
Related rules
- 540703fb-a874-4385-a9d6-7cd1bfab268c (similar)
- 8f2a9c3b-7e5d-4f1a-9b8e-2c4d6a8f9e1b (similar)
References
- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
- https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_indicator.yml
Sources and licences
SigmaHQ
"Shai-Hulud Malware Indicators - Linux" by Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_indicator.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Shai-Hulud Malware Indicators - Linux",
entity page, dataset version ref-faa8e7de1213, updated 2025-11-25T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/11bb9b26-4179-4a06-afcb-1ec31fce1627 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 11bb9b26-4179-4a06-afcb-1ec31fce1627, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.