JS runtime attempted to read Git authentication tokens

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Credential Access (TA0006), Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059), Command and Scripting Interpreter: JavaScript (T1059.007), Unsecured Credentials (T1552)
Severity	Medium

Description

A JavaScript runtime was used to execute a .js file that attempted to read Git personal authentication tokens via the 'gh auth token' command. This behavior is associated with the Mini Shai Hulud campaign, where attackers use lightweight JS engines to execute malicious package code and steal developer credentials.

Attacker's Goals

Steal Git personal authentication tokens to gain access to developer accounts and their associated repositories, enabling supply chain attacks.

Investigative actions

• Investigate the .js file executed by the JS runtime and determine if it is part of a legitimate package.
• Check if the Git authentication tokens were successfully exfiltrated.
• Review the package that triggered the execution for known malicious indicators.
• Check for other signs of the Mini Shai Hulud campaign on the host.

Variations

Uncommon JS runtime attempted to read Git authentication tokens

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006), Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059), Command and Scripting Interpreter: JavaScript (T1059.007), Unsecured Credentials (T1552)
Severity	High

Description

A JavaScript runtime was used to execute a .js file that attempted to read Git personal authentication tokens via the 'gh auth token' command. This behavior is associated with the Mini Shai Hulud campaign, where attackers use lightweight JS engines to execute malicious package code and steal developer credentials.

Attacker's Goals

Steal Git personal authentication tokens to gain access to developer accounts and their associated repositories, enabling supply chain attacks.

Investigative actions

• Investigate the .js file executed by the JS runtime and determine if it is part of a legitimate package.
• Check if the Git authentication tokens were successfully exfiltrated.
• Review the package that triggered the execution for known malicious indicators.
• Check for other signs of the Mini Shai Hulud campaign on the host.