{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The Shai-Hulud framework use of IDE and AI assistant hooks targets high-trust developer environments to harvest secrets with low visibility; a negative result over the developer estate is worth having." }, "name": "Shai-Hulud Framework Supply Chain Hook and Loader Bootstrap", "type": "investigation", "labels": [ "hunt", "attack.t1195", "attack.t1133", "attack.t1059.004", "attack.t1059.007", "attack.t1543.001", "attack.t1543.002" ], "series": { "slug": "shai-hulud-open-source-framework-static-analysis", "index": 1, "title": "Shai-Hulud open source framework static analysis", "total": 3 }, "related": [ { "hunt": "shai-hulud-credential-and-cloud-harvesting", "reason": "This hunt focuses on the initial staging; the next hunt in the series addresses secret harvesting from memory and cloud infrastructure.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule might catch the specific gh-token-monitor name, but this hunt pivots across hook configuration files, daemonization flags, and stack-counts rare process command lines to identify the framework as indicators rotate.", "coverage": [ { "stage": "initial-access-supply-chain-poisoning", "steps": [ "shai-hulud-hook-leads" ], "status": "covered" }, { "stage": "execution-loader-bootstrap", "steps": [ "rare-daemonized-processes" ], "status": "covered" }, { "stage": "persistence-daemon-and-deadman-monitor", "steps": [ "token-monitor-persistence" ], "status": "covered" }, { "stage": "credential-access-memory-and-file-harvesting", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "discovery-cloud-infrastructure-enumeration", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "c2-encrypted-communications", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "exfiltration-github-dead-drops", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "impact-destructive-wipe", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Supply Chain Poisoning & Repository Hijacking", "slug": "initial-access-supply-chain-poisoning", "tactic": "initial-access", "techniques": [ "T1195", "T1133" ], "observables": [ "hijacked Trivy and Checkmarx KICS tags", "poisoned LiteLLM, TanStack, and UiPath npm/PyPI packages", ".vscode/tasks.json with runOn: folderOpen", ".claude/settings.json SessionStart hook", "claude@users.noreply.github.com" ] }, { "name": "Multi-language Loader Execution", "slug": "execution-loader-bootstrap", "tactic": "execution", "techniques": [ "T1059.004", "T1059.007" ], "observables": [ "BASH_LOADER.sh", "PYTHON_LOADER.py", "config.mjs", "setup.mjs", "router_init.js", "opensearch_init.js", "node .claude/setup.mjs", "Bun runtime download" ] }, { "name": "Daemonized Persistence & Token Monitoring", "slug": "persistence-daemon-and-deadman-monitor", "tactic": "persistence", "techniques": [ "T1543.001", "T1543.002" ], "observables": [ "/tmp/tmp.ts018051808.lock", "~/Library/LaunchAgents/com.user.gh-token-monitor.plist", "~/.config/systemd/user/gh-token-monitor.service", "loginctl enable-linger", "__DAEMONIZED=1" ] }, { "name": "Memory Secret Extraction & Credential Harvesting", "slug": "credential-access-memory-and-file-harvesting", "tactic": "credential-access", "techniques": [ "T1003.001", "T1552.001", "T1555" ], "observables": [ "Runner.Worker", "/proc/*/mem scanning", "gh auth token", "~/.aws/credentials", "~/.azure/accessTokens.json", "~/.config/gcloud/credentials.db", "~/.kube/config", "/var/run/secrets/kubernetes.io/serviceaccount/token", ".npmrc", ".pypirc", ".claude.json" ] }, { "name": "Cloud and K8s Secret Discovery", "slug": "discovery-cloud-infrastructure-enumeration", "tactic": "discovery", "techniques": [ "T1580", "T1082" ], "observables": [ "AWS Secrets Manager enumeration", "SSM Parameter Store enumeration", "Kubernetes namespace listing", "HashiCorp Vault KV mount enumeration" ] }, { "name": "Encrypted Domain-based C2", "slug": "c2-encrypted-communications", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1090.003" ], "observables": [ "git-tanstack[.]com", "thebeautifulmarchoftime GitHub commit search", "RSA-4096-OAEP", "AES-256-GCM" ] }, { "name": "GitHub Dead-drop Exfiltration", "slug": "exfiltration-github-dead-drops", "tactic": "exfiltration", "techniques": [ "T1567.001" ], "observables": [ "Shai-Hulud: Here We Go Again repository description", "Dune-themed repo names (sardaukar, mentat, stillsuit)", "results/ directory JSON commits", "IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner" ] }, { "name": "Conditional Data Destruction", "slug": "impact-destructive-wipe", "tactic": "impact", "techniques": [ "T1485" ], "observables": [ "rm -rf ~/", "HTTP 40x response from https://api.github.com/user" ] } ], "summary": "The Shai-Hulud framework by TeamPCP is a modular TypeScript toolkit that targets CI/CD pipelines and developer workstations through supply chain poisoning of npm/PyPI packages and IDE configurations. It extracts credentials from process memory, cloud environments, and local files before exfiltrating encrypted data to C2 domains or GitHub dead-drop repositories, featuring a 'deadman switch' that wipes the user directory if stolen tokens are revoked." }, "severity": "high", "rationale": "Scope to developer workstations and CI/CD runner environments first. Use the hosts found in shai-hulud-hook-leads to populate the scope_hosts parameter for subsequent queries.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "The adversary poisons a developer repository or AI coding assistant configuration to execute the Shai-Hulud loader and establish daemonized persistence.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-05-12" }, "type": "list[host]", "default": [], "description": "Hostnames identified in the lead query to scope subsequent fanned-out queries." }, "loader_files": { "from": { "ref": "shai-hulud-framework-analysis", "kind": "article", "observed": "2026-05-12" }, "type": "list[string]", "default": [ "setup.mjs", "config.mjs", "BASH_LOADER.sh", "PYTHON_LOADER.py", "router_init.js", "opensearch_init.js" ], "description": "Stage-1 loader filenames identified in Shai-Hulud framework research." }, "lookback_days": { "from": { "ref": "hunt-standard-lookback", "kind": "manual", "observed": "2026-05-12" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/", "name": "Shai-Hulud open source framework static analysis" } ], "blind_spots": [ { "id": "lead-data-not-available", "risk": "A host without file telemetry can silently host a poisoned repository that triggers the framework when accessed via an IDE.", "stage": "initial-access-supply-chain-poisoning", "question": "whether hook files were created on hosts not enrolled in the endpoint agent", "requires": "hb_file_activity with full endpoint coverage" }, { "id": "incomplete-telemetry", "risk": "If the attacker rotates the persistence daemon name from gh-token-monitor, it may be missed unless the rare-processes query catches it.", "stage": "persistence-daemon-and-deadman-monitor", "question": "whether the framework establishes persistence via a technique or name not listed in research", "requires": "hb_scheduled_job and hb_process_activity" } ] }, "name": "Shai-Hulud Framework Supply Chain Hook and Loader Bootstrap", "description": "The adversary poisons a developer repository or AI coding assistant configuration to execute the Shai-Hulud loader and establish daemonized persistence. This hunt identifies the entry points and local staging of a Shai-Hulud framework infection. It targets supply chain hooks in IDE and AI assistant configurations, specifically VSCode and Claude Code, which trigger the framework modular loaders. If the query finds leads, the hunt fans out to investigate daemonized process execution and the installation of GitHub token-monitoring persistence. The gated flow ensures that the analyst only queries expensive process and job telemetry for hosts showing early indicators of compromise." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "shai-hulud-open-source-framework-static-analysis", "index": 1, "title": "Shai-Hulud open source framework static analysis", "total": 3 }, "coverage": [ { "stage": "initial-access-supply-chain-poisoning", "steps": [ "shai-hulud-hook-leads" ], "status": "covered" }, { "stage": "execution-loader-bootstrap", "steps": [ "rare-daemonized-processes" ], "status": "covered" }, { "stage": "persistence-daemon-and-deadman-monitor", "steps": [ "token-monitor-persistence" ], "status": "covered" }, { "stage": "credential-access-memory-and-file-harvesting", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "discovery-cloud-infrastructure-enumeration", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "c2-encrypted-communications", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "exfiltration-github-dead-drops", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" }, { "stage": "impact-destructive-wipe", "reason": "Belongs to another part of the 'Shai-Hulud open source framework static analysis' series.", "status": "out_of_scope" } ], "rationale": "The adversary poisons a developer repository or AI coding assistant configuration to execute the Shai-Hulud loader and establish daemonized persistence.", "blind_spots": [ { "id": "lead-data-not-available", "risk": "A host without file telemetry can silently host a poisoned repository that triggers the framework when accessed via an IDE.", "stage": "initial-access-supply-chain-poisoning", "question": "whether hook files were created on hosts not enrolled in the endpoint agent", "requires": "hb_file_activity with full endpoint coverage" }, { "id": "incomplete-telemetry", "risk": "If the attacker rotates the persistence daemon name from gh-token-monitor, it may be missed unless the rare-processes query catches it.", "stage": "persistence-daemon-and-deadman-monitor", "question": "whether the framework establishes persistence via a technique or name not listed in research", "requires": "hb_scheduled_job and hb_process_activity" } ], "scoping_notes": "Scope to developer workstations and CI/CD runner environments first. Use the hosts found in shai-hulud-hook-leads to populate the scope_hosts parameter for subsequent queries.", "beyond_detection": "A single rule might catch the specific gh-token-monitor name, but this hunt pivots across hook configuration files, daemonization flags, and stack-counts rare process command lines to identify the framework as indicators rotate." } }, { "id": "shai-hulud-hook-leads", "type": "query", "label": "Supply Chain Hook and Loader Leads", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{loader_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR LOWER(file_path) LIKE '%/.vscode/tasks.json' OR LOWER(file_path) LIKE '%/.claude/settings.json') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "The query identifies creation of framework loaders or modifications to IDE/AI tool configuration hooks.", "expected_signal": "Any creation of loaders or modifications to VSCode/Claude settings in developer directories represents a lead. Silence suggests no active hook-based staging via these known paths." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Supply Chain Hook and Loader Leads", "reads": [ "device_hostname", "file_name", "file_path", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, activity_name, time FROM hb_file_activity WHERE (instr(',' || '{{loader_files}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR LOWER(file_path) LIKE '%/.vscode/tasks.json' OR LOWER(file_path) LIKE '%/.claude/settings.json') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Any creation of loaders or modifications to VSCode/Claude settings in developer directories represents a lead. Silence suggests no active hook-based staging via these known paths.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "evaluate-lead", "type": "analytic", "label": "Evaluate Hook Leads", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "shai-hulud-hook-leads" ], "objective": "Determine if file activity in shai-hulud-hook-leads represents the initial staging of the Shai-Hulud framework by matching paths and names to the article.", "description": "The agent reviews file activity to determine if a full investigation into persistence and execution is warranted.", "max_iterations": 3, "expected_signal": "A verdict on whether the identified files represent framework staging.", "success_criteria": "A verdict indicating if the leads are suspicious enough to open expensive queries." }, "parents": [ { "id": "shai-hulud-hook-leads" } ] }, { "id": "gate-decision", "type": "checkpoint", "label": "Gate: Proceed to Full Investigation", "config": { "fuzzy": true, "judge": "hunter", "question": "the lead activity suggests the staging of a Shai-Hulud framework component", "condition": "the lead activity suggests the staging of a Shai-Hulud framework component", "blind_spot": "lead-data-not-available", "confidence": "high", "description": "The analyst opens expensive queries only when the initial lead matches known framework patterns.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "evaluate-lead" } ] }, { "id": "rare-daemonized-processes", "type": "query", "label": "Rare Daemonized Framework Execution", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%__daemonized=1%' OR LOWER(process_cmd_line) LIKE '%tmp.ts018051808.lock%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING host_count < 3", "surface": "hb_process_activity", "description": "The query finds rare processes running with the framework daemonization flag or lock file references.", "expected_signal": "A command line seen on only one or two hosts containing the daemonization flag. Silence proving absence is only possible if all hosts report process telemetry." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare Daemonized Framework Execution", "reads": [ "process_cmd_line", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT process_cmd_line, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%__daemonized=1%' OR LOWER(process_cmd_line) LIKE '%tmp.ts018051808.lock%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_cmd_line HAVING host_count < 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A command line seen on only one or two hosts containing the daemonization flag. Silence proving absence is only possible if all hosts report process telemetry.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "token-monitor-persistence", "type": "query", "label": "GitHub Token Monitoring Persistence", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_definition_path, job_cmd_line, time FROM hb_scheduled_job WHERE (LOWER(job_name) LIKE '%gh-token-monitor%' OR LOWER(job_definition_path) LIKE '%gh-token-monitor%' OR LOWER(job_cmd_line) LIKE '%loginctl enable-linger%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_scheduled_job", "description": "The query searches for LaunchAgents, systemd services, or linger settings used for token-revocation monitoring.", "expected_signal": "Persistence entries matching the framework monitor daemon names. Silence means the specific persistence component may be rotated or missing." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "GitHub Token Monitoring Persistence", "reads": [ "device_hostname", "job_name", "job_definition_path", "job_cmd_line", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_definition_path, job_cmd_line, time FROM hb_scheduled_job WHERE (LOWER(job_name) LIKE '%gh-token-monitor%' OR LOWER(job_definition_path) LIKE '%gh-token-monitor%' OR LOWER(job_cmd_line) LIKE '%loginctl enable-linger%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Persistence entries matching the framework monitor daemon names. Silence means the specific persistence component may be rotated or missing.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "final-triage", "type": "analytic", "label": "Final Triage of Framework Infection", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "evaluate-lead", "rare-daemonized-processes", "token-monitor-persistence" ], "objective": "Determine if a host is compromised by the Shai-Hulud framework by weighing the combined evidence from hooks, rare processes, and monitor daemons.", "description": "The agent correlates hook leads, rare daemonized execution, and persistence entries per host.", "max_iterations": 6, "expected_signal": "A comprehensive verdict citing rows across file, process, and job surfaces.", "success_criteria": "A final verdict of malicious | suspicious | benign per host with citations." }, "parents": [ { "id": "rare-daemonized-processes", "kind": "merge" }, { "id": "token-monitor-persistence", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route Final Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the final-triage verdict is malicious for at least one host", "condition": "the final-triage verdict is malicious for at least one host", "blind_spot": "incomplete-telemetry", "confidence": "high", "description": "The decision directs the hunt to containment if the framework presence is confirmed.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "final-triage" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate Compromised Host", "config": { "target": "endpoint", "description": "The analyst immediately contains the host to prevent secret extraction and wipe-upon-revocation impact.", "instructions": "Isolate the host immediately. Do NOT revoke stolen GitHub tokens until the deadman monitor process is killed to prevent the handler from executing 'rm -rf'. Capture memory for secrets analysis.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst Review", "config": { "assignee": "analyst", "description": "The analyst reviews suspicious or indeterminate findings.", "instructions": "Review the identified hook files and the Rare Daemonized Processes query. Confirm if findings represent a variant of the Shai-Hulud framework and update tuning notes." }, "parents": [ { "id": "gate-decision", "branch": "default" }, { "id": "gate-decision", "branch": "on_unavailable" }, { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt Close-out", "config": { "assignee": "analyst", "description": "The analyst summarizes findings and confirms evidence of absence for the estate.", "instructions": "Document the hosts examined. If no indicators were found, record evidence of absence for the known Shai-Hulud staging components." }, "parents": [ { "id": "gate-decision", "branch": "on_refutes" }, { "id": "route-verdict", "branch": "on_refutes" } ] } ] }