Skip to content

Commit 075d25c

Browse files
SamirbousSamirbous
committed
[New/Tuning] NPM Shai-Hulud coverage
https://socket.dev/blog/shai-hulud-strikes-again-v2
1 parent d10dc08 commit 075d25c

File tree

3 files changed

+286
-8
lines changed

3 files changed

+286
-8
lines changed

rules/linux/command_and_control_curl_wget_spawn_via_nodejs_parent.toml renamed to rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml

Lines changed: 30 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
[metadata]
22
creation_date = "2025/09/18"
3-
integration = ["endpoint", "crowdstrike"]
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
44
maturity = "production"
5-
updated_date = "2025/10/17"
5+
updated_date = "2025/11/26"
66

77
[rule]
88
author = ["Elastic"]
@@ -12,7 +12,19 @@ command and control behavior. Adversaries may use Node.js to download additional
1212
the system.
1313
"""
1414
from = "now-9m"
15-
index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*"]
15+
index = [
16+
"endgame-*",
17+
"logs-crowdstrike.fdr*",
18+
"logs-endpoint.events.process-*",
19+
"logs-m365_defender.event-*",
20+
"logs-sentinel_one_cloud_funnel.*",
21+
"logs-system.security*",
22+
"logs-windows.forwarded*",
23+
"logs-windows.sysmon_operational-*",
24+
"winlogbeat-*",
25+
"auditbeat-*",
26+
"logs-auditd_manager.auditd-*"
27+
]
1628
language = "eql"
1729
license = "Elastic License v2"
1830
name = "Curl or Wget Spawned via Node.js"
@@ -77,22 +89,32 @@ severity = "low"
7789
tags = [
7890
"Domain: Endpoint",
7991
"OS: Linux",
92+
"OS: Windows",
93+
"OS: macOS",
8094
"Use Case: Threat Detection",
8195
"Tactic: Command and Control",
82-
"Data Source: Elastic Defend",
8396
"Resources: Investigation Guide",
8497
"Data Source: Crowdstrike",
98+
"Data Source: Elastic Defend",
99+
"Data Source: Windows Security Event Logs",
100+
"Data Source: Microsoft Defender for Endpoint",
101+
"Data Source: Sysmon",
102+
"Data Source: SentinelOne",
103+
"Data Source: Crowdstrike",
104+
"Data Source: Auditd Manager",
85105
]
86106
timestamp_override = "event.ingested"
87107
type = "eql"
88108
query = '''
89-
process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "ProcessRollup2") and process.parent.name == "node" and (
109+
process where event.type == "start" and
110+
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
111+
process.parent.name in ("node", "bun", "node.exe", "bun.exe") and (
90112
(
91-
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
92-
process.args == "-c" and process.command_line like~ ("*curl*", "*wget*")
113+
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "cmd.exe", "bash.exe", "powershell.exe") and
114+
process.command_line like~ ("*curl*http*", "*wget*http*")
93115
) or
94116
(
95-
process.name in ("curl", "wget")
117+
process.name in ("curl", "wget", "curl.exe", "wget.exe")
96118
)
97119
)
98120
'''

‎rules/cross-platform/execution_register_github_actions_runner.toml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
[metadata]
2+
creation_date = "2025/11/26"
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
4+
maturity = "production"
5+
updated_date = "2025/11/26"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects the configuration of a GitHub Actions self-hosted runner using the Runner.Listener binary.
11+
When a machine is registered to a remote repository, its owner gains the ability to execute arbitrary workflow commands on that host.
12+
Unexpected or unauthorized runner registration may indicate adversarial activity aimed at establishing remote code execution
13+
via malicious GitHub workflows.
14+
"""
15+
false_positives = [
16+
"Authorized github repository with no malicious workflow actions.",
17+
]
18+
from = "now-9m"
19+
index = [
20+
"endgame-*",
21+
"logs-crowdstrike.fdr*",
22+
"logs-endpoint.events.process-*",
23+
"logs-m365_defender.event-*",
24+
"logs-sentinel_one_cloud_funnel.*",
25+
"logs-system.security*",
26+
"logs-windows.forwarded*",
27+
"logs-windows.sysmon_operational-*",
28+
"winlogbeat-*",
29+
"auditbeat-*",
30+
"logs-auditd_manager.auditd-*"
31+
]
32+
language = "eql"
33+
license = "Elastic License v2"
34+
name = "Remote GitHub Actions Runner Registration"
35+
note = """## Triage and analysis
36+
37+
### Investigating Remote GitHub Actions Runner Registration
38+
39+
Unexpected or unauthorized Github actions runner registration may indicate adversarial activity aimed at establishing remote code execution via malicious GitHub workflows.
40+
41+
### Possible investigation steps
42+
43+
- Review the remote repository details and reputation.
44+
- Examine the remote repository for any suspicious workflows run commands in the `.github/workflows` folder.
45+
- Examine the execution context like process tree, associated network and file activities.
46+
- Verify if there is adjascent any sensitive file access or collection.
47+
- Correlate with other alerts and investiguate if this activity is related to a supply chain attack.
48+
49+
### False positive analysis
50+
51+
- Authorized configuration changes.
52+
53+
### Response and remediation
54+
55+
- Immediately isolate the affected system from the network to prevent further unauthorized command execution and potential lateral movement.
56+
- Terminate any suspicious child processes that were initiated by the registered Github actions runner.
57+
- Conduct a thorough review of the affected system's logs and configurations to identify any unauthorized changes or additional indicators of compromise.
58+
- Restore the system from a known good backup if any unauthorized changes or malicious activities are confirmed.
59+
- Implement application whitelisting to prevent unauthorized execution.
60+
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on the broader network."""
61+
references = [
62+
"https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
63+
"https://socket.dev/blog/shai-hulud-strikes-again-v2",
64+
]
65+
risk_score = 47
66+
rule_id = "57e118c1-19eb-4c20-93a6-8a6c30a5b48b"
67+
severity = "medium"
68+
tags = [
69+
"Domain: Endpoint",
70+
"OS: Linux",
71+
"OS: Windows",
72+
"OS: macOS",
73+
"Use Case: Threat Detection",
74+
"Tactic: Execution",
75+
"Tactic: Initial Access",
76+
"Data Source: Elastic Endgame",
77+
"Data Source: Elastic Defend",
78+
"Data Source: Windows Security Event Logs",
79+
"Data Source: Microsoft Defender for Endpoint",
80+
"Data Source: Sysmon",
81+
"Data Source: SentinelOne",
82+
"Data Source: Crowdstrike",
83+
"Data Source: Auditd Manager",
84+
"Resources: Investigation Guide",
85+
]
86+
timestamp_override = "event.ingested"
87+
type = "eql"
88+
89+
query = '''
90+
process where event.type == "start" and
91+
process.name in ("Runner.Listener", "Runner.Listener.exe") and
92+
process.args == "configure" and process.args == "--url" and process.args == "--token"
93+
'''
94+
95+
96+
[[rule.threat]]
97+
framework = "MITRE ATT&CK"
98+
[[rule.threat.technique]]
99+
id = "T1059"
100+
name = "Command and Scripting Interpreter"
101+
reference = "https://attack.mitre.org/techniques/T1059/"
102+
103+
104+
105+
[rule.threat.tactic]
106+
id = "TA0002"
107+
name = "Execution"
108+
reference = "https://attack.mitre.org/tactics/TA0002/"
109+
[[rule.threat]]
110+
framework = "MITRE ATT&CK"
111+
[[rule.threat.technique]]
112+
id = "T1195"
113+
name = "Supply Chain Compromise"
114+
reference = "https://attack.mitre.org/techniques/T1195/"
115+
[[rule.threat.technique.subtechnique]]
116+
id = "T1195.002"
117+
name = "Compromise Software Supply Chain"
118+
reference = "https://attack.mitre.org/techniques/T1195/002/"
119+
120+
121+
122+
[rule.threat.tactic]
123+
id = "TA0001"
124+
name = "Initial Access"
125+
reference = "https://attack.mitre.org/tactics/TA0001/"
126+

‎rules/cross-platform/execution_via_github_actions_runner.toml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
[metadata]
2+
creation_date = "2025/11/26"
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
4+
maturity = "production"
5+
updated_date = "2025/11/26"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects potentially dangerous commands spawned by the GitHub Actions Runner.Worker process on self-hosted runner
11+
machines. Adversaries who gain the ability to modify or trigger workflows in a linked GitHub repository can execute
12+
arbitrary commands on the runner host. This behavior may indicate malicious or unexpected workflow activity, including
13+
code execution, file manipulation, or network exfiltration initiated through a compromised repository or unauthorized
14+
workflow.
15+
"""
16+
false_positives = [
17+
"Authorized GitHub actions runner with no malicious workflow actions.",
18+
]
19+
from = "now-9m"
20+
index = [
21+
"endgame-*",
22+
"logs-crowdstrike.fdr*",
23+
"logs-endpoint.events.process-*",
24+
"logs-m365_defender.event-*",
25+
"logs-sentinel_one_cloud_funnel.*",
26+
"logs-system.security*",
27+
"logs-windows.forwarded*",
28+
"logs-windows.sysmon_operational-*",
29+
"winlogbeat-*",
30+
"auditbeat-*",
31+
"logs-auditd_manager.auditd-*"
32+
]
33+
language = "eql"
34+
license = "Elastic License v2"
35+
name = "Execution via GitHub Actions Runner"
36+
note = """## Triage and analysis
37+
38+
### Investigating Execution via GitHub Actions Runner
39+
40+
Adversaries who gain the ability to modify or trigger workflows in a linked GitHub repository can execute arbitrary commands on the runner host.
41+
42+
### Possible investigation steps
43+
44+
- Review the execution details like process.command_line and if it's expected or not.
45+
- Examine associated network and file activities and if there is any ingress tool transfer activity.
46+
- Verify if there is adjascent any sensitive file access or collection.
47+
- Correlate with other alerts and investiguate if this activity is related to a supply chain attack.
48+
49+
### False positive analysis
50+
51+
- Authorized github workflow actions.
52+
53+
### Response and remediation
54+
55+
- Immediately isolate the affected system from the network to prevent further unauthorized command execution and potential lateral movement.
56+
- Terminate any suspicious child processes that were initiated by the Github actions runner.
57+
- Conduct a thorough review of the affected system's logs and configurations to identify any unauthorized changes or additional indicators of compromise.
58+
- Restore the system from a known good backup if any unauthorized changes or malicious activities are confirmed.
59+
- Implement application whitelisting to prevent unauthorized execution.
60+
- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on the broader network."""
61+
references = [
62+
"https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
63+
"https://socket.dev/blog/shai-hulud-strikes-again-v2",
64+
]
65+
risk_score = 47
66+
rule_id = "a640ef5b-e1da-4b17-8391-468fdbd1b517"
67+
severity = "medium"
68+
tags = [
69+
"Domain: Endpoint",
70+
"OS: Linux",
71+
"OS: Windows",
72+
"OS: macOS",
73+
"Use Case: Threat Detection",
74+
"Tactic: Execution",
75+
"Tactic: Initial Access",
76+
"Data Source: Elastic Endgame",
77+
"Data Source: Elastic Defend",
78+
"Data Source: Windows Security Event Logs",
79+
"Data Source: Microsoft Defender for Endpoint",
80+
"Data Source: Sysmon",
81+
"Data Source: SentinelOne",
82+
"Data Source: Crowdstrike",
83+
"Data Source: Auditd Manager",
84+
"Resources: Investigation Guide",
85+
]
86+
timestamp_override = "event.ingested"
87+
type = "eql"
88+
89+
query = '''
90+
process where event.type == "start" and
91+
process.parent.name in ("Runner.Worker", "Runner.Worker.exe") and
92+
(
93+
process.name like ("curl", "curl.exe", "wget", "wget.exe", "powershell.exe", "cmd.exe", "pwsh.exe", "certutil.exe", "rundll32.exe", "bash", "sh", "zsh", "tar", "rm",
94+
"sed", "osascript", "chmod", "nohup", "setsid", "dash", "ash", "tcsh", "csh", "ksh", "fish", "python*", "perl*", "ruby*", "lua*", "php*", "node", "node.exe") or
95+
process.executable : ("/tmp/*", "/private/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "?:\\Users\\*")
96+
)
97+
'''
98+
99+
100+
[[rule.threat]]
101+
framework = "MITRE ATT&CK"
102+
[[rule.threat.technique]]
103+
id = "T1059"
104+
name = "Command and Scripting Interpreter"
105+
reference = "https://attack.mitre.org/techniques/T1059/"
106+
107+
108+
109+
[rule.threat.tactic]
110+
id = "TA0002"
111+
name = "Execution"
112+
reference = "https://attack.mitre.org/tactics/TA0002/"
113+
[[rule.threat]]
114+
framework = "MITRE ATT&CK"
115+
[[rule.threat.technique]]
116+
id = "T1195"
117+
name = "Supply Chain Compromise"
118+
reference = "https://attack.mitre.org/techniques/T1195/"
119+
[[rule.threat.technique.subtechnique]]
120+
id = "T1195.002"
121+
name = "Compromise Software Supply Chain"
122+
reference = "https://attack.mitre.org/techniques/T1195/002/"
123+
124+
125+
126+
[rule.threat.tactic]
127+
id = "TA0001"
128+
name = "Initial Access"
129+
reference = "https://attack.mitre.org/tactics/TA0001/"
130+

0 commit comments

Comments
 (0)