Threat video1:00
Miasma and Shai-Hulud Repo Artifacts: Detection & IOCs
Miasma, Shai-Hulud and ForceMemo leave malicious files in repos and developer machines. Includes 9 detection rules (one free in Splunk SPL) and 30 IOCs.
Read the full threat intel for Miasma and Shai-Hulud Repo Artifacts: Detection & IOCs →
Chapters
- 0:00The hookAbout 5,561 repositories compromised.
- 0:05The storyStepSecurity cataloged supply chain attacks
- 0:11Attack pathAttackers took accounts, pushed malware commits
- 0:23AttributionAttributed to GlassWorm Operators.
- 0:27Indicators of compromise28 indicators to hunt: 7 IPs, 6 domains and 4 SHA-256 hashes, and more.
- 0:36MITRE ATT&CK techniques17 ATT&CK techniques, from initial access to exfiltration.
- 0:41Remediation5 steps now: Hunt repositories, branches, PRs, tags and developer machines for .claude/settings.json.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 5,561 repositories compromised.
0:05StepSecurity cataloged supply chain attacks
0:08Nine named campaigns
0:11Attackers took accounts, pushed malware commits
0:14Credential stealer runs when IDE folder opens
0:18Stolen GitHub PATs exfiltrated to servers
0:23Attributed to GlassWorm Operators. Confidence: low.
0:2828 indicators to hunt: 7 IPs, 6 domains and 4 SHA-256 hashes, and more.
0:3717 ATT&CK techniques, from initial access to exfiltration.
0:425 steps now: Hunt repositories, branches, PRs, tags and developer machines for .claude/settings.json.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.