Linux File Creation of Malicious .github/workflows Shai-Hulud Workflow YAMLs

title: Linux File Creation of Malicious .github/workflows Shai-Hulud Workflow YAMLs
id: b30e6516-0497-4b40-a332-59839f9767a8
status: experimental
description: This rule flags creation of workflow files under the .github/workflows directory with filenames matching shai-hulud-workflow.{yaml|yml} and shai-hulud.{yaml|yml}. Creating or modifying GitHub Actions workflows can give attackers a persistent execution point and a path to access and potentially exfiltrate sensitive repository data. It relies on Linux file event telemetry capturing the target file path on creation.
references:
  - https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/file_event_lnx_mal_shai_hulud_workflow.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
modified: 2026-01-24
tags:
  - attack.persistence
  - attack.credential-access
  - attack.t1552.001
  - attack.collection
  - attack.t1119
  - detection.emerging-threats
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - .github/workflows/shai-hulud-workflow.yaml
      - .github/workflows/shai-hulud-workflow.yml
      - .github/workflows/shai-hulud.yaml
      - .github/workflows/shai-hulud.yml
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0aba5685-6db6-486f-88ef-29a99c545cfd
    type: derived