huntrule

Windows DNS Queries to git-tanstack.com and filev2.getsession.org

Alert on Windows DNS lookups of git-tanstack.com and filev2.getsession.org tied to supply-chain C2/exfil.

FreeReviewedSigma · Medium · v5
Product
windows
Category
dns_query
Author
Leonardo Gasparini (SigmaHQ), DRL 1.1
Published
2026-05-12
Updated
2026-07-31
AnalysisDetection
title: Windows DNS Queries to git-tanstack.com and filev2.getsession.org
id: 6b7b53b1-35df-4715-a632-ab9eb3c08ebd
status: experimental
description: "This rule flags Windows DNS queries for two specific attacker-controlled domains: git-tanstack.com and filev2.getsession.org. These domains are associated with supply-chain compromise activity and subsequent command-and-control and credential exfiltration over the Session protocol. The detection relies on DNS query telemetry that records the queried domain name (QueryName) from Windows hosts."
references:
  - https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
  - https://socket.dev/supply-chain-attacks/mini-shai-hulud
  - https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/TanStack-Supply-Chain/dns_query_win_malware_tanstack_supply_chain_c2.yml
author: Leonardo Gasparini, Huntrule Team
date: 2026-05-12
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1048
  - detection.emerging-threats
logsource:
  category: dns_query
  product: windows
detection:
  selection_attacker_apex:
    QueryName: git-tanstack.com
  selection_session_exfil:
    QueryName: filev2.getsession.org
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
    type: derived