Windows DNS: Queries to git-tanstack.com and filev2.getsession.org for TanStack supply-chain C2/exfil

title: "Windows DNS: Queries to git-tanstack.com and filev2.getsession.org for TanStack supply-chain C2/exfil"
id: 6b7b53b1-35df-4715-a632-ab9eb3c08ebd
status: experimental
description: This rule flags DNS queries from Windows systems to two specific domains associated with attacker-controlled infrastructure. Such traffic can indicate command-and-control activity and credential/session-related data exfiltration attempts. It relies on DNS query logs capturing the queried domain names (QueryName) to match the two indicators.
references:
  - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
  - https://socket.dev/supply-chain-attacks/mini-shai-hulud
  - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/dns_query_win_malware_tanstack_supply_chain_c2.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1048
  - detection.emerging-threats
logsource:
  category: dns_query
  product: windows
detection:
  selection_attacker_apex:
    QueryName: git-tanstack.com
  selection_session_exfil:
    QueryName: filev2.getsession.org
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
    type: derived