Windows: Detect file creation of TanStack runner and router init persistence artifacts

title: "Windows: Detect file creation of TanStack runner and router init persistence artifacts"
id: a94a33ef-4c3a-40a9-8d78-7b7e33de4468
status: experimental
description: This rule flags Windows file creation events for specific JavaScript and runtime artifacts associated with a TanStack-related supply-chain intrusion pattern. Attackers may write these files to establish execution paths or persistence under user or development directories. It relies on Windows file event telemetry with TargetFilename ending in the listed router_init, tanstack_runner, and router_runtime locations.
references:
  - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
  - https://socket.dev/supply-chain-attacks/mini-shai-hulud
  - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/file_event_win_malware_tanstack_supply_chain.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - attack.persistence
  - attack.t1554
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_malware_files:
    TargetFilename|endswith:
      - \router_init.js
      - \tanstack_runner.js
  selection_persistence_claude_vscode:
    TargetFilename|endswith:
      - \.claude\router_runtime.js
      - \.vscode\router_runtime.js
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8a3f2c1e-5d7b-4e9a-b6c8-1f2a3d4e5f6a
    type: derived