Windows Process Creation: bun_environment.js Executed via bun.exe from node.exe

Flags node.exe spawning bun.exe with a command line containing bun_environment.js and a GitHub runner release download.

FreeUnreviewedSigmahighv1

windows-process-creation-bun-environment-js-executed-via-bun-exe-from-node-exe-5299fadf

title: "Windows Process Creation: bun_environment.js Executed via bun.exe from node.exe"
id: 03d20580-db3b-406d-9f92-20d20ed6d40a
related:
  - id: eb827bbd-670a-4d58-8446-c464d8ac2323
    type: similar
  - id: 5299fadf-f228-4526-8274-251db1960be9
    type: derived
status: experimental
description: This rule matches Windows process creation where a parent process ending with \node.exe launches a child process ending with \bun.exe. The child command line must contain both a reference to bun_environment.js and a GitHub release download URL, indicating scripted retrieval of a payload. This matters because it captures a common attacker pattern of using Node.js to bootstrap execution through the Bun runtime and then run a specific JavaScript payload.
references:
  - https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
  - https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_node_bun_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
  - attack.t1195.002
  - attack.t1203
  - attack.execution
  - attack.initial-access
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \node.exe
  selection_child_bun_script:
    Image|endswith: \bun.exe
    CommandLine|contains:
      - bun_environment.js
      - https://github.com/actions/runner/releases/download/v2.330.0
  condition: selection_parent and 1 of selection_child_*
falsepositives:
  - Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_node_bun_execution/info.yml
license: DRL-1.1

What it detects

This rule matches Windows process creation where a parent process ending with \node.exe launches a child process ending with \bun.exe. The child command line must contain both a reference to bun_environment.js and a GitHub release download URL, indicating scripted retrieval of a payload. This matters because it captures a common attacker pattern of using Node.js to bootstrap execution through the Bun runtime and then run a specific JavaScript payload.

Known false positives

Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.