All Detections

Bun Executing over HTTP/S

avatar
Ibrahim Saud@tektrix
updated Jun 19, 2026003

Detects bun.exe executing scripts directly from remote URLs, a common fallback behavior for these worms.

Microsoft Sentinel (KQL)