All Detections

Mini Shai-Hulud - Node Fallback to Curl/Wget for Hardcoded IPs

avatar
Ibrahim Saud@tektrix
updated Jun 19, 2026006

Detects node.exe spawning curl or wget pointing directly to the hardcoded C2 IPs (94.154.172.43, 91.195.240.123) indicating stage 2 download.

Microsoft Sentinel (KQL)