T1485: Shai-Hulud gh-token-monitor Dead-Man's Switch Home Directory Wipe

Tim Peck@timpeck

•updated today•0•0•0

Detects the Shai-Hulud supply chain attack dead-man's switch: a gh-token-monitor persistence component followed by a recursive forced deletion of the user home directory, or the presence of the specific kill-switch string in a command line.