Windows Process Creation: Shai-Hulud String Indicators in Command Line
Alerts on Windows process executions whose command line includes Shai-Hulud indicator strings.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-25
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events whose command line contains either the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed recognizable markers in execution arguments, making these strings useful for spotting specific malware-related activity. It relies on process creation telemetry with access to the full command line.
Reporting behind it
- wiz.iohttps://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- aikido.devhttps://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
- semgrep.devhttps://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_indicator.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-matching-shai-hulud-command-line-indicators-540703fb
title: "Windows Process Creation: Shai-Hulud String Indicators in Command Line"
id: a85985a5-c05a-4c99-8bbc-0d149d4bf868
related:
- id: 11bb9b26-4179-4a06-afcb-1ec31fce1627
type: similar
- id: 8f2a9c3b-7e5d-4f1a-9b8e-2c4d6a8f9e1b
type: similar
- id: 540703fb-a874-4385-a9d6-7cd1bfab268c
type: derived
status: experimental
description: This rule flags Windows process creation events whose command line contains either the strings "Shai-Hulud" or "SHA1HULUD". Attackers may embed recognizable markers in execution arguments, making these strings useful for spotting specific malware-related activity. It relies on process creation telemetry with access to the full command line.
references:
- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
- https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_indicator.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
- attack.execution
- attack.t1059
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- Shai-Hulud
- SHA1HULUD
condition: selection
falsepositives:
- Legitimate software containing similar strings
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_indicator/info.yml
license: DRL-1.1