Hayabusa high experimental sigma

TanStack Supply-Chain Attack Execution Indicators - Windows

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection": {
    "CommandLine
| contains
| all": [
      "run",
      "tanstack_runner.js"
    ],
    "NewProcessName
| endswith": "\\bun.exe"
  },
  "condition": "process_creation and selection"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...