Merge PR SigmaHQ#5658 from @swachchhanda000 - feat: shai hulud worm targeting npm supply chain attack

new - Shai-Hulud Malicious GitHub Workflow Creation
new - Shai-Hulud NPM Attack GitHub Activity
new - Shai-Hulud NPM Package Malicious Exfiltration via Curl
new - PUA - TruffleHog Execution
new - PUA - TruffleHog Execution - Linux

Author: swachchhanda000

rules-emerging-threats/2025/Malware/Shai-Hulud/file_event_lnx_mal_shai_hulud_workflow.yml

@@ -0,0 +1,25 @@
+title: Shai-Hulud Malicious GitHub Workflow Creation
+id: 0aba5685-6db6-486f-88ef-29a99c545cfd
+status: experimental
+description: Detects creation of shai-hulud-workflow.yml file associated with Shai Hulud worm targeting NPM supply chain attack that exfiltrates GitHub secrets
+references:
+    - https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-09-24
+tags:
+    - attack.persistence
+    - attack.credential-access
+    - attack.t1552.001
+    - attack.collection
+    - attack.t1119
+    - detection.emerging-threats
+logsource:
+    product: linux
+    category: file_event
+detection:
+    selection:
+        TargetFilename|endswith: '.github/workflows/shai-hulud-workflow.yml'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2025/Malware/Shai-Hulud/github_mal_shai_hulud_npm_attack.yml

@@ -0,0 +1,24 @@
+title: Shai-Hulud NPM Attack GitHub Activity
+id: 69fa9174-4370-4646-8d48-6a22e2853402
+status: experimental
+description: |
+    Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch,
+    inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
+references:
+    - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-09-24
+tags:
+    - attack.persistence
+    - attack.impact
+    - detection.emerging-threats
+logsource:
+    product: github
+    service: audit
+detection:
+    selection:
+        - 'shai-hulud-workflow.yml'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high

rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hululd_exfiltration.yml

@@ -0,0 +1,28 @@
+title: Shai-Hulud NPM Package Malicious Exfiltration via Curl
+id: efd2eb09-b72e-4a61-8dc7-b1382a1e8983
+status: experimental
+description: Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
+references:
+    - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-09-24
+tags:
+    - attack.exfiltration
+    - attack.t1041
+    - attack.collection
+    - attack.t1005
+    - detection.emerging-threats
+logsource:
+    category: process_creation
+    product: linux
+detection:
+    selection:
+        Image|endswith: '/curl'
+        CommandLine|contains|all:
+            - 'curl'
+            - '-d'
+            - 'webhook.site/bb8ca5f6-4175-45d2-b042-fc9ebb8170b7'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: high

rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml

@@ -0,0 +1,42 @@
+title: PUA - TruffleHog Execution - Linux
+id: d7a650c4-226c-451e-948f-cc490db506aa
+related:
+    - id: 44030449-b0df-4c94-aae1-502359ab28ee
+      type: similar
+status: experimental
+description: |
+    Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
+    While it is a legitimate tool, intended for use in CI pipelines and security assessments,
+    It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
+references:
+    - https://github.com/trufflesecurity/trufflehog
+    - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-09-24
+tags:
+    - attack.discovery
+    - attack.t1083
+    - attack.t1552.001
+logsource:
+    category: process_creation
+    product: linux
+detection:
+    selection_img:
+        Image|endswith: '/trufflehog'
+    selection_cli_platform:
+        CommandLine|contains:
+            - ' docker --image '
+            - ' Git '
+            - ' GitHub '
+            - ' Jira '
+            - ' Slack '
+            - ' Confluence '
+            - ' SharePoint '
+            - ' s3 '
+            - ' gcs '
+    selection_cli_verified:
+        CommandLine|contains: ' --results=verified'
+    condition: selection_img or all of selection_cli_*
+falsepositives:
+    - Legitimate use of TruffleHog by security teams or developers.
+level: medium

rules/windows/process_creation/proc_creation_win_pua_trufflehog.yml

@@ -0,0 +1,42 @@
+title: PUA - TruffleHog Execution
+id: 44030449-b0df-4c94-aae1-502359ab28ee
+related:
+    - id: d7a650c4-226c-451e-948f-cc490db506aa
+      type: similar
+status: experimental
+description: |
+    Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
+    While it is a legitimate tool, intended for use in CI pipelines and security assessments,
+    It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
+references:
+    - https://github.com/trufflesecurity/trufflehog
+    - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-09-24
+tags:
+    - attack.discovery
+    - attack.t1083
+    - attack.t1552.001
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_img:
+        Image|endswith: '\trufflehog.exe'
+    selection_cli_platform:
+        CommandLine|contains:
+            - ' docker --image '
+            - ' Git '
+            - ' GitHub '
+            - ' Jira '
+            - ' Slack '
+            - ' Confluence '
+            - ' SharePoint '
+            - ' s3 '
+            - ' gcs '
+    selection_cli_verified:
+        CommandLine|contains: ' --results=verified'
+    condition: selection_img or all of selection_cli_*
+falsepositives:
+    - Legitimate use of TruffleHog by security teams or developers.
+level: medium