Shai-Hulud Exfiltration to Webhook.site

Mehulkumar Savajani@Msavajani

•updated Dec 3, 2025•22•0•246

Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.