Shai-Hulud NPM Worm & ClickFix WebDAV: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential Shai-Hulud NPM Worm Activity
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects suspicious behavior associated with the Shai-Hulud npm worm where npm install spawns the Bun runtime or accesses IMDS.
status: experimental
date: 2026/07/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/679a2b2d8a9c7b0012345678
tags:
    - attack.initial_access
    - attack.credential_access
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: \
        - '\npm.cmd'
        - '\node.exe'
    selection_child:
        Image|endswith: \
        - '\bun.exe'
    selection_imds:
        CommandLine|contains:
            - '169.254.169.254'
            - 'metadata'
    condition: 1 of selection*
falsepositives:
    - Legitimate build processes using Bun
level: high

---

title: Suspicious Rundll32 WebDAV Execution (ClickFix)
id: b2c3d4e5-6789-01bc-def2-234567890abc
description: Detects rundll32.exe loading a DLL via ordinal export over a WebDAV connection, a technique used by ClickFix campaigns.
status: experimental
date: 2026/07/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/679a2b2d8a9c7b0012345679
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\rundll32.exe'
    selection_ordinal:
        CommandLine|contains: '#1'
    selection_webdav:
        CommandLine|contains:
            - 'http://'
            - 'https://'
    filter_legit:
        CommandLine|contains:
            - 'windows'
            - 'system32'
    condition: selection_img and selection_ordinal and selection_webdav and not filter_legit
falsepositives:
    - Legacy legitimate application installers
level: critical

---

title: PasasteSinTAG Phishing Domain Access
id: c3d4e5f6-7890-12cd-ef23-345678901bcd
description: Detects DNS queries to known PasasteSinTAG typosquatting domains associated with credential harvesting.
status: experimental
date: 2026/07/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/679a2b2d8a9c7b0012345680
tags:
    - attack.credential_access
    - attack.social_engineering
logsource:
    category: dns
    product: windows
detection:
    selection_keyword:
        QueryName|contains:
            - 'pasastesintag'
            - 'parastesintago'
    selection_tlds:
        QueryName|endswith:
            - '.click'
            - '.cfd'
            - '.cyou'
            - '.mom'
            - '.top'
            - '.rest'
    condition: selection_keyword and selection_tlds
falsepositives:
    - Legitimate access to the official domain (if similar naming exists)
level: medium

// Hunt for ClickFix-like Rundll32 activity over WebDAV
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has ".dll,#1" and (ProcessCommandLine has "http://" or ProcessCommandLine has "https://")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend URL = extract("(https?\\://[^\\s]+)", 1, ProcessCommandLine)
| order by Timestamp desc

// Hunt for NPM spawning suspicious child processes (Shai-Hulud)
DeviceProcessEvents
| where Timestamp > ago(3d)
| where InitiatingProcessFileName has "npm"
| where FileName in ("bun.exe", "powershell.exe", "cmd.exe") or ProcessCommandLine has "169.254.169.254"
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName
| order by Timestamp desc

// DNS queries for PasasteSinTAG typosquatting
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType == "DnsQuerySuccess"
| where RemoteUrl has "pasastesintag" or RemoteUrl has "parastesintago"
| extend TLD = extract("\\.(\\w+)$", 1, RemoteUrl)
| where TLD in ("click", "cfd", "cyou", "mom", "top", "rest", "help", "sbs", "icu")
| summarize count() by RemoteUrl, DeviceName, bin(Timestamp, 1h)
| order by count_ desc

<#
.SYNOPSIS
    Hunt script for Shai-Hulud and ClickFix indicators.
.DESCRIPTION
    Checks for recent Bun executable executions (npm worm) and suspicious Rundll32 command lines.
#>

# Check for Bun execution in recent event logs (Shai-Hulud)
Write-Host "Checking for Shai-Hulud NPM Worm activity (Bun.exe)..."
$BunEvents = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName']='*\bun.exe']]*" -ErrorAction SilentlyContinue
if ($BunEvents) {
    Write-Host "[ALERT] Found bun.exe executions:" -ForegroundColor Red
    $BunEvents | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "No bun.exe execution found in Security logs." -ForegroundColor Green
}

# Check for suspicious RunDLL32 command lines (ClickFix)
Write-Host "\nChecking for ClickFix activity (Rundll32 + WebDAV)..."
$Processes = Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'rundll32.exe' }
foreach ($Proc in $Processes) {
    $CmdLine = $Proc.CommandLine
    if ($CmdLine -match 'http[s]?://.*#\d+' -or ($CmdLine -match '.*\\.dll.*#1' -and $CmdLine -match 'http')) {
        Write-Host "[ALERT] Suspicious Rundll32 process detected with WebDAV/Ordinal syntax:" -ForegroundColor Red
        Write-Host "PID: $($Proc.ProcessId)"
        Write-Host "Command: $CmdLine"
    }
}

# Check for npm cache compromise (File check for specific IOCs if applicable or generic check)
Write-Host "\nChecking recent npm install logs..."
$NpmLogs = "$env:APPDATA\npm-cache\_logs" 
if (Test-Path $NpmLogs) {
    $RecentLogs = Get-ChildItem $NpmLogs -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-2) }
    if ($RecentLogs) {
        Write-Host "Found recent npm activity. Review logs manually at $NpmLogs"
    }
}