Threat report

www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack

https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
Published on
www.wiz.io
Sources in this catalogue
2

ATT&CK techniques those detections carry

  • T1195Supply Chain Compromise
  • T1059Command and Scripting Interpreter
  • T1195.002Compromise Software Supply Chain
  • T1020Automated Exfiltration
  • T1195.001Compromise Software Dependencies and Development Tools
  • T1565Data Manipulation
  • T1565.001Stored Data Manipulation
  • T1567Exfiltration Over Web Service
  • +32 more
Open the original

17 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Node.js Pre or Post-Install Script ExecutionMedium
New GitHub Personal Access Token (PAT) AddedLow
New GitHub Self Hosted Action RunnerMedium
GitHub Actions Workflow Modification BlockedMedium
GitHub Actions Unusual Bot Push to RepositoryLow
High Number of Protected Branch Force Pushes by UserMedium
Several Failed Protected Branch Force Pushes by UserMedium
High Number of Closed Pull Requests by UserMedium
Github Activity on a Private Repository from an Unusual IPLow
GitHub Exfiltration via High Number of Repository Clones by UserMedium
GitHub Secret Scanning DisabledLow
Tampering with RUNNER_TRACKING_ID in GitHub Actions RunnersMedium
Privileged Container Creation with Host Directory MountHigh
Multiple Cloud Secrets Accessed by Source AddressHigh
Shai-Hulud Workflow File Creation or ModificationMedium
Shai-Hulud 2 Exfiltration Artifact FilesMedium
GitHub Enterprise Register Self Hosted RunnerInformational

Showing 17 of 17

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice