Shai-Hulud gh-token-monitor persistence (systemd, LaunchAgent, scheduled task)

Adarsh Pandey@Pandeyadarsh

•updated today•2•0•2

Detects the creation or modification of persistence artifacts related to the gh-token-monitor component, which acts as a dead-man's switch monitor. This includes Linux systemd user units, macOS LaunchAgents, Windows scheduled tasks, and associated command-line execution.