Sigma rule: Shai-Hulud Malicious Bun Execution - Linux

Rule

Title

Shai-Hulud Malicious Bun Execution - Linux

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2025-11-25

File

rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_malicious_node_bun_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.

Log source

product

linux

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '/node'
selection_child_bun:
    Image|endswith: '/bun'
    CommandLine|contains:
        - 'bun_environment.js'
        - 'https://github.com/actions/runner/releases/download/v2.330.0'
selection_child_setup_curl:
    CommandLine|contains|all:
        - 'curl '
        - '-fsSL'
        - 'https://bun.sh/install'
        - 'bash'
selection_child_path_reload:
    CommandLine|contains|all:
        - 'bash -c "source '
        - '&& echo'
condition: selection_parent and 1 of selection_child_*

False positives (as the rule lists them)

• Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.

Tags

• attack.t1195.002
• attack.t1203
• attack.execution
• attack.initial-access
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1195.002
• T1203

Related rules

• 5299fadf-f228-4526-8274-251db1960be9 (similar)

References

• https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
• https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
• https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_malicious_node_bun_execution.yml