Linux Process Creation: Shai-Hulud String Indicators in Command Line
Alerts on Linux process command lines containing Shai-Hulud or SHA1HULUD indicator strings.
- Product
- linux
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-25
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process creation events where the process command line contains the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed recognizable naming or markers in malware components or launch arguments to support development, targeting, or operational behavior. Detection relies on process creation telemetry that includes the full command line for each spawned process.
Reporting behind it
- wiz.iohttps://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- aikido.devhttps://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
- semgrep.devhttps://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_indicator.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux Process Creation: Shai-Hulud String Indicators in Command Line"
id: ab7da9da-44b5-4aa8-8090-719a1f7612fa
related:
- id: 540703fb-a874-4385-a9d6-7cd1bfab268c
type: similar
- id: 8f2a9c3b-7e5d-4f1a-9b8e-2c4d6a8f9e1b
type: similar
- id: 11bb9b26-4179-4a06-afcb-1ec31fce1627
type: derived
status: experimental
description: This rule flags Linux process creation events where the process command line contains the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed recognizable naming or markers in malware components or launch arguments to support development, targeting, or operational behavior. Detection relies on process creation telemetry that includes the full command line for each spawned process.
references:
- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
- https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_indicator.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
- attack.execution
- attack.t1059
- detection.emerging-threats
logsource:
category: process_creation
product: linux
detection:
selection:
CommandLine|contains:
- Shai-Hulud
- SHA1HULUD
condition: selection
falsepositives:
- Legitimate software containing similar strings
level: high
license: DRL-1.1