T1555.003: Shai-Hulud tensorlake HackBrowserData Download and Execution

Tim Peck@timpeck

•updated today•0•0•1

Detects the Shai-Hulud tensorlake payload pattern of fetching a platform-specific HackBrowserData binary and then executing it on the same host to dump browser-stored credentials. Anchored on tool behavior (download then execution on one host) rather than a single sample hash or the rotating C2 domain.