Node to Shell to Bun Execution Chain
This rule detects a multi-step execution chain where Node.js (or npm) spawns a shell process, which then launches Bun. This pattern has been observed in malicious packages to hide the final payload from simple scanners. It is crucial to review the full parent-child process tree for any alerts. Users should be questioned about recent software installations or clicked links, and security teams should be involved if the activity is suspicious.
Microsoft Sentinel (KQL)
