CrowdStrike npm Packages Supply Chain Attack Shai-Hulud C2 Connections

Thomas Carr@Tomcat

•updated Sep 17, 2025•12•2•321

This rule detects network connections initiated by a process with a command line containing "filesystem", "--json", and "--results=verified", which is used to scan the entire filesystem. This specific combination of command-line arguments is associated with the Shai-Hulud malware.