huntrule

Linux File Events: Malicious GitHub Workflow File Creation (shai-hulud-workflow*.yml/yaml)

Alerts on new .github/workflows YAML files named for Shai-Hulud, indicating potential malicious GitHub Actions persistence.

FreeReviewedSigma · High · v5
Product
linux
Category
file_event
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-09-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags the creation of specific GitHub Actions workflow files under .github/workflows with names matching shai-hulud-workflow*.yml/yaml. Creating workflow definitions can enable persistence and automation that may access or exfiltrate sensitive repository information when actions run. It relies on Linux file creation telemetry for paths ending in the listed workflow filenames.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange
Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation
Suspicious Recursive Credential and Wallet Search Written to Temp Inventory File
Windows Process Creation: Automated Document and Directory Discovery via dir and findstr
Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation
Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)
Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail
Suspicious GitHub CLI Auth Token Extraction via Command Line
Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)
Suspicious mdfind Search for Private Key Files on macOS (via process_creation)
Linux File Events: Malicious GitHub Workflow File Creation (shai-hulud-workflow*.yml/yaml)
Pivot detection · T1552.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.