ET MALWARE Shai-Hulud (Here We Go Again) NPM Malware Github Commit Marker Search

7.0.35.0SID: 2071389Rev: 1Enabled6 views
Sourceet/open
Fileemerging-malware.rules
CreatedAugust 5, 2026
UpdatedAugust 5, 2026
Classificationcommand-and-control
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Shai-Hulud (Here We Go Again) NPM Malware Github Commit Marker Search"; flow:established,to_server; http.uri; content:"/search/commits?q=thebeautifulmarchoftime|25|20&sort=author-date&order=desc"; fast_pattern; http.accept; content:"application/vnd.github+json"; http.user_agent; content:"node"; http.method; content:"GET"; reference:url,research.jfrog.com/post/shai-hulud-is-back-august/; classtype:command-and-control; sid:2071389; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_08_05, deployment Perimeter, malware_family Shai_Hulud, confidence High, signature_severity Critical, updated_at 2026_08_05;)

References

urlresearch.jfrog.com/post/shai-hulud-is-back-august/

Metadata

attack targetClient_Endpoint
tls stateTLSDecrypt
created at2026_08_05
deploymentPerimeter
malware familyShai_Hulud
confidenceHigh
signature severityCritical
updated at2026_08_05

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!