Shai-Hulud

News

• Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub DataDark Reading · 22 Sep 2026

MITRE ATT&CK techniques

Reconnaissance

• T1593.003 Code Repositories 2 Sigma rules

Resource Development

• T1608.001 Upload Malware

Initial Access

• T1078.004 Cloud Accounts 35 Sigma rules
• T1195.001 Compromise Software Dependencies and Development Tools 2 Sigma rules

Execution

• T1059.001 PowerShell 40 Sigma rules
• T1059.004 Unix Shell 17 Sigma rules
• T1059.007 JavaScript 26 Sigma rules
• T1677 Poisoned Pipeline Execution

Persistence

• T1098 Account Manipulation 36 Sigma rules
• T1543.002 Systemd Service 3 Sigma rules
• T1546.016 Installer Packages

Privilege Escalation

• T1548.003 Sudo and Sudo Caching 3 Sigma rules

Credential Access

• T1528 Steal Application Access Token 13 Sigma rules
• T1552.001 Credentials In Files 20 Sigma rules
• T1552.005 Cloud Instance Metadata API
• T1555.006 Cloud Secrets Management Stores

Discovery

• T1082 System Information Discovery 18 Sigma rules

Lateral Movement

• T1550.001 Application Access Token 2 Sigma rules

Collection

• T1119 Automated Collection 5 Sigma rules
• T1213.003 Code Repositories 4 Sigma rules

Command and Control

• T1071.001 Web Protocols 39 Sigma rules
• T1105 Ingress Tool Transfer 40 Sigma rules

Exfiltration

• T1041 Exfiltration Over C2 Channel 4 Sigma rules
• T1567.001 Exfiltration to Code Repository 1 Sigma rules
• T1567.004 Exfiltration Over Webhook

Impact

• T1485 Data Destruction 15 Sigma rules

Stealth

• T1027 Obfuscated Files or Information 61 Sigma rules
• T1036.005 Match Legitimate Resource Name or Location 20 Sigma rules
• T1036.009 Break Process Trees
• T1564.011 Ignore Process Interrupts
• T1678 Delay Execution

Defense impairment

• T1553 Subvert Trust Controls 18 Sigma rules
• T1685 Disable or Modify Tools 81 Sigma rules