Windows DNS Queries to git-tanstack.com and filev2.getsession.org
Alert on Windows DNS lookups of git-tanstack.com and filev2.getsession.org tied to supply-chain C2/exfil.
- Product
- windows
- Category
- dns_query
- Author
- Leonardo Gasparini (SigmaHQ), DRL 1.1
- Published
- 2026-05-12
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows DNS queries for two specific attacker-controlled domains: git-tanstack.com and filev2.getsession.org. These domains are associated with supply-chain compromise activity and subsequent command-and-control and credential exfiltration over the Session protocol. The detection relies on DNS query telemetry that records the queried domain name (QueryName) from Windows hosts.
Reporting behind it
- socket.devhttps://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- socket.devhttps://socket.dev/supply-chain-attacks/mini-shai-hulud
- safedep.iohttps://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/dns_query_win_malware_tanstack_supply_chain_c2.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DNS Queries to git-tanstack.com and filev2.getsession.org
id: 6b7b53b1-35df-4715-a632-ab9eb3c08ebd
status: experimental
description: "This rule flags Windows DNS queries for two specific attacker-controlled domains: git-tanstack.com and filev2.getsession.org. These domains are associated with supply-chain compromise activity and subsequent command-and-control and credential exfiltration over the Session protocol. The detection relies on DNS query telemetry that records the queried domain name (QueryName) from Windows hosts."
references:
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- https://socket.dev/supply-chain-attacks/mini-shai-hulud
- https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/dns_query_win_malware_tanstack_supply_chain_c2.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
- attack.command-and-control
- attack.t1071.001
- attack.exfiltration
- attack.t1048
- detection.emerging-threats
logsource:
category: dns_query
product: windows
detection:
selection_attacker_apex:
QueryName: git-tanstack.com
selection_session_exfil:
QueryName: filev2.getsession.org
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
type: derived