Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects outbound network connections to known C2 domains associated with the Mini Shai-Hulud supply chain worm, used to exfiltrate stolen credentials from developer machines and CI/CD pipelines.
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Detects the execution of the Bun runtime attempting to execute known malicious scripts associated with the Mini Shai-Hulud supply chain compromise. Attackers use Bun during npm installation to evade traditional Node.js security monitoring.
Detects Python processes attempting to read process memory (/proc/*/mem) or using a specific shell pipeline to scrape GitHub Actions Runner memory for masked secrets, as observed in the Mini Shai-Hulud supply chain attack.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
Detects the deletion of RDP Bitmap Cache files (.bin, .bmc) within the Terminal Server Client Cache folder. Adversaries perform this as an anti-forensics technique to cover their tracks after harvesting session data for image fragment reconstruction.
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
Detects the deletion of RDP Bitmap Cache files (.bin, .bmc) within the Terminal Server Client Cache folder. Adversaries perform this as an anti-forensics technique to cover their tracks after harvesting session data for image fragment reconstruction.
Page 8 of 13