AI IDE Miasma Trigger Execution
Detects Node.js or Bun executing specific hidden setup files indicative of the Miasma payload being triggered by IDE configuration files (Cursor, Claude, Gemini, VSCode). This rule looks for process execution where the filename is 'node.exe', 'node', 'bun.exe', 'bun', or common shells ('cmd.exe', 'powershell.exe', 'pwsh.exe', 'bash', 'sh', 'zsh') and the command line contains specific Miasma payload patterns like '.github/setup.js', '.claude/setup.mjs', or 'bun run' with '.config/index.js'.
Microsoft Sentinel (KQL)
