Bun Executing Discovered Hades Stealer Payload
Detects process command lines executing an `_index.js` payload using the Bun runtime, which is characteristic of the Hades stealer's execution chain where a Python loader downloads Bun to execute an obfuscated JavaScript payload.
Microsoft Sentinel (KQL)
