Shai-Hulud dead-man's switch home directory wipe via gh-token-monitor
Detects the Shai-Hulud dead-man's switch mechanism, including the gh-token-monitor persistence component or specific kill-switch markers triggering a recursive wipe of the user's home directory on Linux or Windows systems.
Microsoft Sentinel (KQL)

