Shai-Hulud Malicious Bun Execution - Linux
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_parent:
ParentImage|endswith: '/node'
selection_child_bun:
Image|endswith: '/bun'
CommandLine|contains:
- 'bun_environment.js'
- 'https://github.com/actions/runner/releases/download/v2.330.0'
selection_child_setup_curl:
CommandLine|contains|all:
- 'curl '
- '-fsSL'
- 'https://bun.sh/install'
- 'bash'
selection_child_path_reload:
CommandLine|contains|all:
- 'bash -c "source '
- '&& echo'
condition: selection_parent and 1 of selection_child_*Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.
Sub-techniques
Other