Shai-Hulud GitHub Repo Creation

Mehulkumar Savajani@Msavajani

•updated Nov 27, 2025•2•0•116

This rule detects the creation of a public GitHub repository with the specific description "Sha1-Hulud: The Second Coming". This is an indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.