TeamPCP Supply Chain Campaign: Checkmarx Jenkins Plugin & Mini Shai-Hulud Worm

---
title: Potential Malicious Jenkins Plugin Execution - Checkmarx TeamPCP
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious child processes spawned by the Jenkins Java process related to the Checkmarx plugin, indicative of the TeamPCP supply chain compromise.
references:
  - https://isc.sans.edu/diary/rss/32994
author: Security Arsenal
date: 2026/05/18
tags:
  - attack.execution
  - attack.t1059.001
  - attack.software_supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\java.exe'
    ParentCommandLine|contains: 'checkmarx'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate Checkmarx plugin scripting (verify with admin)
level: critical
---
title: Suspicious Package Manager Post-Install Activity - Mini Shai-Hulud
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects npm or pip spawning shells or making network connections immediately after execution, typical behavior of the Mini Shai-Hulud worm.
references:
  - https://isc.sans.edu/diary/rss/32994
author: Security Arsenal
date: 2026/05/18
tags:
  - attack.execution
  - attack.t1059.006
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_pkg:
    Image|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\pip.exe'
      - '\python.exe'
  selection_suspicious:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_pkg and selection_suspicious
falsepositives:
  - Developer scripts using shell wrappers for installs (rare)
level: high

// Hunt for TeamPCP Mini Shai-Hulud Worm activity via npm/pip
// Look for package managers initiating network connections or shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName in~ ("npm.exe", "pip.exe", "python.exe", "node.exe")
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "bash.exe") or 
        (ProcessCommandLine contains "install" and 
         (ProcessCommandLine contains "http" or ProcessCommandLine contains "post-install"))
| project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend IoC = "Suspicious Package Install Chain"

// Hunt for Jenkins Checkmarx Plugin Compromise
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "java.exe"
| where InitiatingProcessCommandLine contains "checkmarx"
| where ProcessName in~ ("cmd.exe", "powershell.exe", "sh", "bash")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| extend IoC = "Jenkins Checkmarx RCE"

-- Hunt for Mini Shai-Hulud worm artifacts in npm and PyPI environments
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='/*/*/.npm/_cacache/**/*')
WHERE Mtime > now() - 7d
  AND Name =~ "malware"

-- Hunt for suspicious Jenkins plugin JAR modifications
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='C:\Program Files\Jenkins\plugins\checkmarx/**/*.hpi')
WHERE Mtime > now() - 30d
  AND Size < 10MB 
-- Note: Verify file size against vendor known-good hash; suspicious replacements often differ in size

-- Check for npm scripts invoking shells (Linux/Mac)
SELECT CommandLine, Exe, Username
FROM pslist()
WHERE Exe =~ 'npm'
  AND CommandLine =~ 'sh'
  OR CommandLine =~ 'bash'

# PowerShell: Check Jenkins Checkmarx Plugin Version and Integrity
# Note: Update the $ExpectedHash and $SafeVersion with values from the official vendor advisory.

$JenkinsHome = "C:\Program Files\Jenkins"
$PluginDir = Join-Path $JenkinsHome "plugins"
$PluginName = "checkmarx"

Write-Host "[+] Auditing Jenkins Plugin: $PluginName" -ForegroundColor Cyan

# Locate the plugin file (hpi or jpi)
$PluginFile = Get-ChildItem -Path $PluginDir -Filter "$PluginName*.hpi" -ErrorAction SilentlyContinue
if (-not $PluginFile) {
    $PluginFile = Get-ChildItem -Path $PluginDir -Filter "$PluginName*.jpi" -ErrorAction SilentlyContinue
}

if ($PluginFile) {
    Write-Host "[!] Found Plugin: $($PluginFile.FullName)" -ForegroundColor Yellow
    Write-Host "    Modified: $($PluginFile.LastWriteTime)"
    
    # Compare against known safe version date (Example: March 1, 2026)
    if ($PluginFile.LastWriteTime -gt (Get-Date "2026-03-01")) {
        Write-Host "[CRITICAL] Plugin was recently modified. Potential compromise detected." -ForegroundColor Red
        Write-Host "[ACTION] Disable the plugin immediately via UI and download the latest version from the official Update Center."
    } else {
        Write-Host "[INFO] Plugin date appears stable, but verify version against advisory." -ForegroundColor Green
    }
} else {
    Write-Host "[INFO] Checkmarx plugin not found on this host." -ForegroundColor Gray
}

#!/bin/bash
# Bash: Hunt for Mini Shai-Hulud worm indicators in Node/Python environments

echo "[*] Scanning for suspicious npm packages..."
# Check for recently modified packages in node_modules that are not standard
find /home -type d -name "node_modules" -exec find {} -type f -name "*.js" -mtime -7 \; 2>/dev/null | head -20

echo "[*] Checking for unusual pip install activity..."
grep -r "pip install" ~/.bash_history | tail -10

echo "[*] Checking for known malicious package names (Mini Shai-Hulud indicators)"
# List of example indicators (replace with actual IoCs from threat intel)
MALICIOUS_PKGS=("malicious-pkg-example" "shai-hulud-worm")
for pkg in "${MALICIOUS_PKGS[@]}"; do
  if npm list -g | grep -q "$pkg"; then
    echo "[ALERT] Suspicious npm package found: $pkg"
  fi
done