Miasma Developer Tool Inventory Enumeration via node.exe or bun.exe

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•5

Detects the Miasma malware attempting to enumerate installed developer and AI coding tools by executing version-check or help commands. The rule monitors for a pattern of 5 or more child process executions from 'node.exe' or 'bun.exe' within a 30-second window, which targets tools like VS Code, Cursor, Claude, AWS CLI, kubectl, helm, npm, git, and docker.