GitHub Runner Persistence (SHA1HULUD)

Mehulkumar Savajani@Msavajani

•updated Dec 3, 2025•26•1•256

Detects the creation of a persistent GitHub self-hosted runner named 'SHA1HULUD', a technique used by the Shai-Hulud 2.0 malware for persistence and remote command execution. The rule specifically looks for process command lines containing " --name SHA1HULUD".