Mini Shai-Hulud Detection Suite 6 Detection Rules
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Microsoft Sentinel (KQL)
