BRIDGEHEAD payload hosted on attacker GitHub release (main.exe)
Detects the download or presence of the BRIDGEHEAD malware payload (main.exe), specifically the version hosted on GitHub release infrastructure associated with the BRIDGEHEAD npm typosquatting campaign.
YARA
