ET MALWARE Shai-Hulud (Here We Go Again) NPM Malware Github Repository Creation

7.0.35.0SID: 2071385Rev: 1Enabled5 views
Sourceet/open
Fileemerging-malware.rules
CreatedAugust 4, 2026
UpdatedAugust 4, 2026
Classificationcommand-and-control
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Shai-Hulud (Here We Go Again) NPM Malware Github Repository Creation"; flow:established,to_server; http.uri; content:"/repos"; endswith; http.host; content:"github"; http.request_body; content:"|22|Shai-Hulud|3a| Here We Go Again|22|"; fast_pattern; http.method; content:"POST"; reference:url,research.jfrog.com/post/shai-hulud-is-back-august/; classtype:command-and-control; sid:2071385; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_08_04, deployment Perimeter, malware_family Shai_Hulud, performance_impact Low, confidence Medium, signature_severity Critical, updated_at 2026_08_04;)

References

urlresearch.jfrog.com/post/shai-hulud-is-back-august/

Metadata

attack targetClient_Endpoint
tls stateTLSDecrypt
created at2026_08_04
deploymentPerimeter
malware familyShai_Hulud
performance impactLow
confidenceMedium
signature severityCritical
updated at2026_08_04

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!