Detects malicious JavaScript worm bun_environment.js

Hunt Hypothesis

This detection identifies the execution of a malicious JavaScript worm named bun_environment.js, which adversaries likely deploy to establish persistence and propagate lateral movement within cloud workloads. SOC teams should proactively hunt for this artifact in Azure Sentinel because its critical severity indicates a high risk of rapid infection across interconnected resources, necessitating immediate containment before the worm compromises sensitive data or disrupts service availability.

YARA Rule

rule MAL_JS_NPM_SupplyChain_Attack_Nov25 {
   meta:
      description = "Detects malicious JavaScript worm bun_environment.js"
      author = "Marius Benthin"
      date = "2025-11-24"
      modified = "2025-12-15"
      reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
      hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
      score = 80
      id = "11726cbe-48a7-577a-9694-8f38ffa746e1"
   strings:
      $sa1 = "npm publish"
      $sa2 = "NPM_TOKEN"
      $sa3 = "NPM_CONFIG_TOKEN"

      $sb1 = "GITHUB_"
      $sb2 = "GITLAB_"
      $sb3 = "TEAMCITY_"
   condition:
      filesize < 20MB
      and all of ($sa*)
      and 2 of ($sb*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects malicious JavaScript worm bun_environment.js rule, including suggested filters and exclusions:

Scenario: Automated Build Pipeline Execution
- Context: The enterprise CI/CD pipeline (e.g., Jenkins or Azure DevOps) utilizes a Node.js-based build agent that dynamically generates bun_environment.js as part of the runtime configuration for containerized microservices. This file is created and executed during every nightly deployment window.
- Filter/Exclusion: Create an exclusion rule based on the Process Name (node.exe, java.exe) and Parent Process (e.g., jenkins-agent.exe or azdagent). Additionally, exclude any execution occurring within the specific network segment of the build cluster (e.g., subnet 10.20.45.0/24).
Scenario: Scheduled Maintenance Script for DevOps Tooling
- Context: A scheduled Windows Task runs every Monday at 03:00 AM to update local development environments using a custom script that imports the bun_environment.js module from the internal artifact repository (e.g., Artifactory or Nexus). This is a standard administrative task for refreshing developer workstations.
- Filter/Exclusion: Implement a time-based filter to suppress alerts between 02:30 AM and 04:30 AM on weekdays. Alternatively, add an exclusion for the specific file path C:\ProgramData\DevOps\Scripts\bun_environment.js if the hash of this legitimate file is known.
Scenario: Third-Party SaaS Integration Agent
- Context: The organization uses a third-party monitoring agent (e.g., Datadog or New Relic) that injects bun_environment.js into web browsers to capture real-time