Threat video1:00
Shai-Hulud, Miasma and Hades Worms: Detection & IOCs
TeamPCP's Shai-Hulud worm republishes poisoned npm and PyPI packages to steal CI/CD tokens. It ships 9 detection rules, 25 IOCs and a free Splunk SPL rule.
Read the full threat intel for Shai-Hulud, Miasma and Hades Worms: Detection & IOCs →
Chapters
- 0:00The hookSelf-propagating worms steal credentials.
- 0:04The storyTeamPCP open-sourced it.
- 0:10Attack pathReportedly, worms steal secrets.
- 0:21AttributionAttributed to TeamPCP.
- 0:25Indicators of compromise21 indicators to hunt: 1 domain, 6 SHA-256 hashes and 6 file names, and more.
- 0:33MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to impact.
- 0:38Remediation5 steps now: Hunt for setup_bun.js, bun_environment.js, .github/workflows/discussion.yaml and shai-hulud-workflow.yml in repositories.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Self-propagating worms steal credentials.
0:05TeamPCP open-sourced it.
0:07Copycats reuse it.
0:10Reportedly, worms steal secrets.
0:12Maintainers fall, then trojanized packages.
0:16Installs trigger preinstall hooks.
0:21Attributed to TeamPCP. Confidence: medium.
0:2521 indicators to hunt: 1 domain, 6 SHA-256 hashes and 6 file names, and more.
0:3418 ATT&CK techniques, from initial access to impact.
0:385 steps now: Hunt for setup_bun.js, bun_environment.js, .github/workflows/discussion.yaml and shai-hulud-workflow.yml in repositories.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.