Sigma rule: Shai-Hulud Malicious Bun Execution

Rule

Title

Shai-Hulud Malicious Bun Execution

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-25

File

rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_node_bun_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '\node.exe'
selection_child_bun_script:
    Image|endswith: '\bun.exe'
    CommandLine|contains:
        - 'bun_environment.js'
        - 'https://github.com/actions/runner/releases/download/v2.330.0'
condition: selection_parent and 1 of selection_child_*

False positives (as the rule lists them)

• Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.

Tags

• attack.t1195.002
• attack.t1203
• attack.execution
• attack.initial-access
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1195.002
• T1203

Related rules

• eb827bbd-670a-4d58-8446-c464d8ac2323 (similar)

References

• https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
• https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
• https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js
• https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_node_bun_execution.yml