Miasma Worm EDR Discovery via Process Enumeration

Ethan Andrews@eandrews

•updated Jun 10, 2026•16•0•28

Identifies the execution of process enumeration commands ('ps aux' or 'tasklist') spawned by Node.js or Bun environments, a technique used by the Miasma worm to detect running EDR agents before executing credential harvesting routines.