Node/Bun process sweeping multiple credential stores (Shai-Hulud tensorlake)
Detects a Node.js or Bun runtime process accessing multiple distinct credential stores or configuration files (such as AWS credentials, Kubernetes configs, SSH keys, or .env files) within a short window, indicative of credential harvesting malware such as the Shai-Hulud tensorlake variant.
Microsoft Sentinel (KQL)
