T1543.002: Shai-Hulud gh-token-monitor Persistence (systemd, LaunchAgent, Schedu

Tim Peck@timpeck

•updated today•0•0•1

Detects the creation of persistence artifacts associated with the 'gh-token-monitor' service utilized by the Shai-Hulud worm across Linux systemd user services, macOS LaunchAgents, and Windows scheduled tasks or local application directories. This service acts as a dead-man's switch designed to wipe the user's home directory if the stolen GitHub token is revoked.