Shai-Hulud Campaign: Tensorlake NPM Package and GitHub Token Harvesting Activity
This threat hunting query identifies process executions associated with the Shai-Hulud supply-chain campaign by detecting the execution of the known malicious script Math_Symbol.js and references to indicators such as gh-token-monitor and tensorlake within command-line activity. These artifacts have been linked to malicious npm packages used to harvest GitHub credentials and tokens from developer environments, potentially enabling unauthorized access to source code repositories and software supply chains.
Microsoft Sentinel (KQL)
