Linux File Events: Malicious GitHub Workflow File Creation (shai-hulud-workflow*.yml/yaml)

Alerts on new .github/workflows YAML files named for Shai-Hulud, indicating potential malicious GitHub Actions persistence.

FreeReviewedSigma · High · v5

Product: linux
Category: file_event
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-09-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
- T1119Automated Collection
C2
Exfiltration
Impact

What it detects

This rule flags the creation of specific GitHub Actions workflow files under .github/workflows with names matching shai-hulud-workflow*.yml/yaml. Creating workflow definitions can enable persistence and automation that may access or exfiltrate sensitive repository information when actions run. It relies on Linux file creation telemetry for paths ending in the listed workflow filenames.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious Recursive Credential and Wallet Search Written to Temp Inventory File

Windows Process Creation: Automated Document and Directory Discovery via dir and findstr

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious LameHug Staging Directory and Info File Creation on Windows

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Linux File Events: Malicious GitHub Workflow File Creation (shai-hulud-workflow*.yml/yaml)

Pivot detection · T1552.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-file-creation-of-malicious-github-workflows-shai-hulud-workflow-yamls-0aba5685

title: "Linux File Events: Malicious GitHub Workflow File Creation (shai-hulud-workflow*.yml/yaml)"
id: b30e6516-0497-4b40-a332-59839f9767a8
status: experimental
description: This rule flags the creation of specific GitHub Actions workflow files under .github/workflows with names matching shai-hulud-workflow*.yml/yaml. Creating workflow definitions can enable persistence and automation that may access or exfiltrate sensitive repository information when actions run. It relies on Linux file creation telemetry for paths ending in the listed workflow filenames.
references:
  - https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/file_event_lnx_mal_shai_hulud_workflow.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
modified: 2026-01-24
tags:
  - attack.persistence
  - attack.credential-access
  - attack.t1552.001
  - attack.collection
  - attack.t1119
  - detection.emerging-threats
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - .github/workflows/shai-hulud-workflow.yaml
      - .github/workflows/shai-hulud-workflow.yml
      - .github/workflows/shai-hulud.yaml
      - .github/workflows/shai-hulud.yml
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0aba5685-6db6-486f-88ef-29a99c545cfd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL