Mini Shai-Hulud - Bun Payload Execution to kosche C2 Beacon

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•4

This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.