Windows Process Creation Matching Shai-Hulud Command Line Indicators

Alerts on Windows process executions whose command line includes Shai-Hulud indicator strings.

FreeUnreviewedSigmahighv1

windows-process-creation-matching-shai-hulud-command-line-indicators-540703fb

title: Windows Process Creation Matching Shai-Hulud Command Line Indicators
id: a85985a5-c05a-4c99-8bbc-0d149d4bf868
related:
  - id: 11bb9b26-4179-4a06-afcb-1ec31fce1627
    type: similar
  - id: 8f2a9c3b-7e5d-4f1a-9b8e-2c4d6a8f9e1b
    type: similar
  - id: 540703fb-a874-4385-a9d6-7cd1bfab268c
    type: derived
status: experimental
description: This rule flags Windows process creation events whose command line contains the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed distinctive names or identifiers in execution arguments, and spotting these indicators can help surface suspicious activity tied to malware execution. The detection relies on process creation telemetry that includes the full command line.
references:
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_indicator.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - Shai-Hulud
      - SHA1HULUD
  condition: selection
falsepositives:
  - Legitimate software containing similar strings
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_indicator/info.yml
license: DRL-1.1

What it detects

This rule flags Windows process creation events whose command line contains the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed distinctive names or identifiers in execution arguments, and spotting these indicators can help surface suspicious activity tied to malware execution. The detection relies on process creation telemetry that includes the full command line.

Known false positives

Legitimate software containing similar strings

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.