--- analysis: A standard rule might detect an individual file read; this hunt correlates secret harvesting from memory with a surge in discovery traffic across multiple surfaces, identifying a coordinated campaign rather than a lone anomalous event. blind_spots: - id: no-endpoint-visibility question: Whether secret files were accessed on unmanaged workstations or BYOD devices. requires: hb_file_activity with endpoint agent coverage risk: An intruder can harvest secrets from an unmanaged machine and use them to pivot into the cloud environment invisibly to this hunt. stage: credential-access-memory-and-file-harvesting - id: encrypted-discovery-traffic question: Whether specific Secrets Manager or SSM Parameter Store API calls were made. requires: hb_http_activity with TLS inspection for AWS API endpoints risk: Without TLS inspection, discovery activity appears as generic HTTPS traffic to AWS, masking the volume and nature of the enumeration. stage: discovery-cloud-infrastructure-enumeration coverage: - stage: credential-access-memory-and-file-harvesting status: covered steps: - lead-sensitive-file-access - baseline-memory-access - stage: discovery-cloud-infrastructure-enumeration status: covered steps: - cloud-discovery-traffic - reason: Covered in the supply chain poisoning hunt of this series. stage: initial-access-supply-chain-poisoning status: out_of_scope - reason: Covered in the execution hunt of this series. stage: execution-loader-bootstrap status: out_of_scope - reason: Covered in the persistence hunt of this series. stage: persistence-daemon-and-deadman-monitor status: out_of_scope - reason: Covered in the exfiltration hunt of this series. stage: c2-encrypted-communications status: out_of_scope - reason: Covered in the exfiltration hunt of this series. stage: exfiltration-github-dead-drops status: out_of_scope - reason: Covered in the exfiltration hunt of this series. stage: impact-destructive-wipe status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: The Shai-Hulud frameworks ability to extract secrets from process memory bypasses standard masking; a negative result over the fleet provides assurance that this pervasive supply chain threat has not established a beachhead. methodology: model-assisted trigger: intel-report hypothesis: An intruder has deployed the Shai-Hulud framework to extract credentials from filesystem paths and process memory, subsequently using them to automate the discovery of cloud and Kubernetes infrastructure secrets. labels: - hunt - attack.t1003.001 - attack.t1082 - attack.t1552.001 - attack.t1555 - attack.t1580 name: Shai-Hulud Secret Harvesting and Discovery parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-05-12' ref: default type: number scope_hosts: default: [] description: Optional list of hosts to focus investigation; if empty, the entire fleet is queried. from: kind: manual observed: '2026-05-12' ref: analyst-scoping type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Prioritize GitHub Actions runners (self-hosted and managed) and developer workstations. Focus on hosts running Linux or macOS where /proc or configuration directories are accessible. references: - name: Shai-Hulud open source framework static analysis url: https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/ related: - hunt: shai-hulud-loader-execution reason: The loader must execute first to bootstrap the environment that performs the harvesting. relation: precedes - hunt: shai-hulud-exfiltration-c2 reason: Harvested and discovered secrets are later exfiltrated via encrypted channels. relation: follows - hunt: shai-hulud-supply-chain-loader relation: follows scenario: stages: - name: Supply Chain Poisoning & Repository Hijacking observables: - hijacked Trivy and Checkmarx KICS tags - poisoned LiteLLM, TanStack, and UiPath npm/PyPI packages - '.vscode/tasks.json with runOn: folderOpen' - .claude/settings.json SessionStart hook - claude@users.noreply.github.com slug: initial-access-supply-chain-poisoning tactic: initial-access techniques: - T1195 - T1133 - name: Multi-language Loader Execution observables: - BASH_LOADER.sh - PYTHON_LOADER.py - config.mjs - setup.mjs - router_init.js - opensearch_init.js - node .claude/setup.mjs - Bun runtime download slug: execution-loader-bootstrap tactic: execution techniques: - T1059.004 - T1059.007 - name: Daemonized Persistence & Token Monitoring observables: - /tmp/tmp.ts018051808.lock - ~/Library/LaunchAgents/com.user.gh-token-monitor.plist - ~/.config/systemd/user/gh-token-monitor.service - loginctl enable-linger - __DAEMONIZED=1 slug: persistence-daemon-and-deadman-monitor tactic: persistence techniques: - T1543.001 - T1543.002 - name: Memory Secret Extraction & Credential Harvesting observables: - Runner.Worker - /proc/*/mem scanning - gh auth token - ~/.aws/credentials - ~/.azure/accessTokens.json - ~/.config/gcloud/credentials.db - ~/.kube/config - /var/run/secrets/kubernetes.io/serviceaccount/token - .npmrc - .pypirc - .claude.json slug: credential-access-memory-and-file-harvesting tactic: credential-access techniques: - T1003.001 - T1552.001 - T1555 - name: Cloud and K8s Secret Discovery observables: - AWS Secrets Manager enumeration - SSM Parameter Store enumeration - Kubernetes namespace listing - HashiCorp Vault KV mount enumeration slug: discovery-cloud-infrastructure-enumeration tactic: discovery techniques: - T1580 - T1082 - name: Encrypted Domain-based C2 observables: - git-tanstack[.]com - thebeautifulmarchoftime GitHub commit search - RSA-4096-OAEP - AES-256-GCM slug: c2-encrypted-communications tactic: command-and-control techniques: - T1071.001 - T1090.003 - name: GitHub Dead-drop Exfiltration observables: - 'Shai-Hulud: Here We Go Again repository description' - Dune-themed repo names (sardaukar, mentat, stillsuit) - results/ directory JSON commits - IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner slug: exfiltration-github-dead-drops tactic: exfiltration techniques: - T1567.001 - name: Conditional Data Destruction observables: - rm -rf ~/ - HTTP 40x response from https://api.github.com/user slug: impact-destructive-wipe tactic: impact techniques: - T1485 summary: The Shai-Hulud framework by TeamPCP is a modular TypeScript toolkit that targets CI/CD pipelines and developer workstations through supply chain poisoning of npm/PyPI packages and IDE configurations. It extracts credentials from process memory, cloud environments, and local files before exfiltrating encrypted data to C2 domains or GitHub dead-drop repositories, featuring a 'deadman switch' that wipes the user directory if stolen tokens are revoked. series: index: 2 slug: shai-hulud-open-source-framework-static-analysis title: Shai-Hulud open source framework static analysis total: 3 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Shai-Hulud Secret Harvesting and Discovery This hunt targets the internal logic of the Shai-Hulud framework as it traverses the filesystem and memory to aggregate credentials. Shai-Hulud specifically targets AWS, Azure, and Kubernetes configuration files, and it attempts to dump the memory of the GitHub Runner.Worker process to bypass secret masking. The hunt identifies these harvesting patterns and correlates them with subsequent automated enumeration of cloud secret stores like AWS Secrets Manager or the Kubernetes API. We start by scoping for sensitive file access, then fan out to baseline memory reads and cloud discovery traffic. ## lead-sensitive-file-access Identify hosts where processes are reading sensitive cloud or developer credentials using a high-performance filter for known target filenames. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: Hosts and processes accessing high-value credential files. Silence means no such files were touched by monitored processes. reads: - device_hostname - actor_user_name - file_path - file_name - process_name - time - activity_id silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, actor_user_name, file_path, file_name, process_name, time FROM hb_file_activity WHERE activity_id = 2 AND LOWER(file_name) IN ('credentials', 'accesstokens.json', 'credentials.db', 'config', '.npmrc', '.pypirc', '.env') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## parallel-investigation parallel: - → baseline-memory-access - → cloud-discovery-traffic join: → triage-agent ## baseline-memory-access Find rare instances of processes reading their own or other processes memory, specifically targeting runner.worker as identified in framework static analysis. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A list of processes performing rare memory reads across the fleet. Silence suggests no such scraping occurred on scoped hosts. prevalence: by: device_hostname key: - process_name rare_below: 3 reads: - process_name - device_hostname - file_path - time - activity_id - process_cmd_line silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT process_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_file_activity WHERE activity_id = 2 AND LOWER(file_path) LIKE '/proc/%/mem' AND (LOWER(process_name) LIKE '%runner.worker%' OR LOWER(process_cmd_line) LIKE '%runner.worker%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name HAVING host_count <= 3 ORDER BY host_count ASC ``` ## cloud-discovery-traffic Detect high-volume or rare enumeration of cloud secrets or Kubernetes namespaces to distinguish standard developer activity from anomalous discovery. ```sqlite target=web role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A surge in API requests or rare API paths used for secret storage services. Silence means no such enumeration was visible. reads: - device_hostname - url_hostname - url_path - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT url_path, url_hostname, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS req_count, MIN(time) AS first_seen FROM hb_http_activity WHERE (LOWER(url_hostname) LIKE '%secretsmanager%' OR LOWER(url_hostname) LIKE '%ssm%' OR LOWER(url_path) LIKE '%/api/v1/namespaces%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_path, url_hostname HAVING host_count <= 3 ORDER BY req_count DESC ``` ## triage-agent ```agent target=hunter cite: required context: - lead-sensitive-file-access - baseline-memory-access - cloud-discovery-traffic max_iterations: 6 objective: Determine if a host has been used to harvest credentials from files or memory, and if those credentials were used to enumerate cloud secrets. success_criteria: A per-host verdict of malicious | suspicious | benign citing specific process names and discovery URLs. tools: - endpoint - web ``` ## verdict-decision if~: "the triage verdict is malicious for at least one host indicating confirmed harvesting followed by enumeration" (confidence: high, judge=hunter) then: → contain-host indeterminate: → analyst-validation unavailable: → analyst-validation (blind_spot: no-endpoint-visibility) else: → analyst-validation ## contain-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Notify the cloud security team to rotate any IAM credentials or K8s tokens that were present on the host. ``` → analyst-validation ## analyst-validation ```manual target=analyst Review the process lineage for the memory reads. Cross-reference the HTTP discovery traffic with CloudTrail logs to confirm which specific Secrets Manager paths were accessed. ``` → close-out ## close-out ```manual target=analyst Document the malicious process names and paths. If the behavior was confirmed, promote the memory access logic to a permanent detection rule for Linux and macOS environments. ``` → end