CrowdStrike npm Packages Supply Chain Attack Shai-Hulud Payload being Dropped

Thomas Carr@Tomcat

•updated Sep 17, 2025•9•0•235

This rule detects the creation of an executable file (.exe) that is being extracted by an archive where the command line includes 'tar -xzf' and a '.tar.gz' archive.