Hayabusa medium experimental sigma

TanStack Supply-Chain Attack File Creation Indicators - Windows

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.

View Source

Detection Logic

{
  "file_event": {
    "EventID": 11,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_malware_files": {
    "TargetFilename
| endswith": [
      "\\router_init.js",
      "\\tanstack_runner.js"
    ]
  },
  "selection_persistence_claude_vscode": {
    "TargetFilename
| endswith": [
      "\\.claude\\router_runtime.js",
      "\\.vscode\\router_runtime.js"
    ]
  },
  "condition": "file_event and (1 of selection_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...