PSNATCH/BASHNATCH exfiltration to GitHub via SmartUploader agent

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•3

Detects evidence of PSNATCH or BASHNATCH tools exfiltrating data to GitHub. The rule identifies suspicious file operations related to an 'SmartUploader' tracking file in standard user directories (AppData, .local/share), monitors for SmartUploader process execution, and flags network connections to api.github.com from processes identified as SmartUploader, bash, or PowerShell.