Linux Bun Runtime Execution: bun_environment.js via node-parent process

Flags /node-launched /bun executions running bun_environment.js with an external runner release download URL.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-11-25
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions on Linux where a parent process whose path ends with /node spawns a /bun process running a command line that includes bun_environment.js. It also matches related behavior where the command line shows downloading and installing Bun using curl from bun.sh, followed by shell sourcing/reload activity. This matters because supply-chain malware may use Bun to execute a staged JavaScript payload, and the rule relies on process creation telemetry including parent image, child image, and full command-line content.

Reporting behind it

Related detections9 linkedT1195.002 — drag to rearrange

Windows Process Creation: Bun executes bun_environment.js via node.exe

Suspicious Child Process Spawned by Python Interpreter via Process Creation

Suspicious npm Postinstall Node Execution From Fixtures Path (BeaverTail OtterCookie)

Suspicious TrueConf Update Chain Spawning Temporary Executable in Operation TrueChaos

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

Malicious PowerShell Download from bullethost.cloud Staging Server

Suspicious NPM Install Hook Executing Setup Script via Node

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Linux Bun Runtime Execution: bun_environment.js via node-parent process

Pivot detection · T1195.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-bun-runtime-execution-of-bun-environment-js-from-node-parent-process-eb827bbd

title: "Linux Bun Runtime Execution: bun_environment.js via node-parent process"
id: 0e1dee9a-e81d-4450-a2f3-d3aa12534313
related:
  - id: 5299fadf-f228-4526-8274-251db1960be9
    type: similar
  - id: eb827bbd-670a-4d58-8446-c464d8ac2323
    type: derived
status: experimental
description: This rule identifies process executions on Linux where a parent process whose path ends with /node spawns a /bun process running a command line that includes bun_environment.js. It also matches related behavior where the command line shows downloading and installing Bun using curl from bun.sh, followed by shell sourcing/reload activity. This matters because supply-chain malware may use Bun to execute a staged JavaScript payload, and the rule relies on process creation telemetry including parent image, child image, and full command-line content.
references:
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hulud_malicious_node_bun_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
  - attack.t1195.002
  - attack.t1203
  - attack.execution
  - attack.initial-access
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /node
  selection_child_bun:
    Image|endswith: /bun
    CommandLine|contains:
      - bun_environment.js
      - https://github.com/actions/runner/releases/download/v2.330.0
  selection_child_setup_curl:
    CommandLine|contains|all:
      - "curl "
      - -fsSL
      - https://bun.sh/install
      - bash
  selection_child_path_reload:
    CommandLine|contains|all:
      - 'bash -c "source '
      - "&& echo"
  condition: selection_parent and 1 of selection_child_*
falsepositives:
  - Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL