feat: shai hulud worm targeting npm supply chain attack

[swachchhanda000]

Summary of the Pull Request

Changelog

new - Shai-Hulud Malicious GitHub Workflow Creation
new - Shai-Hulud NPM Attack GitHub Activity
new - Shai-Hulud NPM Package Malicious Exfiltration via Curl
new - PUA - TruffleHog Execution
new - PUA - TruffleHog Execution - Linux

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull Request Overview

Adds new Sigma rules to detect Shai-Hulud NPM supply chain attack behaviors (malicious workflow creation, GitHub activity, data exfiltration) and potentially unwanted TruffleHog executions on Windows and Linux.

• Introduces TruffleHog PUA process creation detection for Windows and Linux.
• Adds emerging threat rules for Shai-Hulud malicious workflow file creation, GitHub audit activity, and curl-based exfiltration.
• Provides campaign-focused tagging and references for emerging threat context.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
rules/windows/process_creation/proc_creation_win_pua_trufflehog.yml	New Windows TruffleHog execution detection rule.
rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml	New Linux TruffleHog execution detection rule.
rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hululd_exfiltration.yml	Curl-based exfiltration detection for Shai-Hulud on Linux.
rules-emerging-threats/2025/Malware/Shai-Hulud/github_mal_shai_hulud_npm_attack.yml	GitHub audit rule for malicious workflow activity.
rules-emerging-threats/2025/Malware/Shai-Hulud/file_event_lnx_mal_shai_hulud_workflow.yml	Detects creation of malicious workflow file on filesystem.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}