Linux Process Creation: Shai-Hulud and SHA1HULUD Command Line Indicators

Alerts on Linux process command lines containing Shai-Hulud or SHA1HULUD indicator strings.

FreeUnreviewedSigmahighv1

linux-process-creation-shai-hulud-and-sha1hulud-command-line-indicators-11bb9b26

title: "Linux Process Creation: Shai-Hulud and SHA1HULUD Command Line Indicators"
id: ab7da9da-44b5-4aa8-8090-719a1f7612fa
related:
  - id: 540703fb-a874-4385-a9d6-7cd1bfab268c
    type: similar
  - id: 8f2a9c3b-7e5d-4f1a-9b8e-2c4d6a8f9e1b
    type: similar
  - id: 11bb9b26-4179-4a06-afcb-1ec31fce1627
    type: derived
status: experimental
description: This rule flags Linux process creation events where the command line contains the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed such identifiers in malware tooling or scripts, making this a useful indicator for early triage. It relies on process creation telemetry with accessible command-line arguments and matches only on substring presence in the command line.
references:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_indicator.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - Shai-Hulud
      - SHA1HULUD
  condition: selection
falsepositives:
  - Legitimate software containing similar strings
level: high
license: DRL-1.1

What it detects

This rule flags Linux process creation events where the command line contains the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed such identifiers in malware tooling or scripts, making this a useful indicator for early triage. It relies on process creation telemetry with accessible command-line arguments and matches only on substring presence in the command line.

Known false positives

Legitimate software containing similar strings

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.