Egress Network Connection from Node.js Descendant

Time window: 1m
Sequence by: process.entity_id
Source: github.com/elastic/protections-artifacts

This rule detects when a network connection is established via a descendant of a Node.js process. Attackers may use Node.js to run scripts that create network connections for various malicious purposes, such as downloading and executing payloads, establishing persistence, or exfiltrating data.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.004` Command and Scripting Interpreter: Unix Shell
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

[rule]
description = """
This rule detects when a network connection is established via a descendant of a Node.js process. Attackers may use
Node.js to run scripts that create network connections for various malicious purposes, such as downloading and executing
payloads, establishing persistence, or exfiltrating data.
"""
id = "adf59538-f71f-45e2-a3ae-af95b31c41df"
license = "Elastic License v2"
name = "Egress Network Connection from Node.js Descendant"
os_list = ["macos"]
version = "1.0.8"

query = '''
sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and event.action == "exec" and not process.name == "node" and 
   (
     descendant of [process where event.type == "start" and event.action == "exec" and process.name == "node" and 
       (
         process.command_line : ("*post-install*", "*preinstall*") or 
         (process.args like "*/npm" and process.args in ("install", "update"))
      )] or 
     (process.parent.name == "node" and process.parent.command_line like ("*post-install*", "*preinstall*")) or 
     (process.parent.name == "node" and process.parent.args like "*/npm" and process.parent.args in ("install", "update"))
    ) and not (
      (process.name == "sh" and process.args == "-c" and process.args == "node") or
      process.args like ("rebuild", "build", "compile", "copyfiles*") or
      process.command_line in (
        "sh -c :; (node ./preinstall.js > /dev/null 2>&1 || true)",
        """sh -c  node -e "try{require('./_postinstall')}catch(e){}" || exit 0"""
      )
    ) and (
    process.name like (
      "nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
      "nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm"
    ) or
    process.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*"
    ) or
    (
       process.name == "curl" and process.args like "*http*" and process.args in ("-o", "--output") and
       process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
    ) or
    (
      process.name == "wget" and process.args like "*http*" and process.args in ("-O", "--output-document") and
      process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
    ) or
    (process.name : "python*" and process.args : "-c" and process.args : (
     "*import*pty*spawn*", "*import*subprocess*call*"
    )) or
    (process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : (
     "*exec*", "*system*"
    )) or
    (process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : (
     "*TCPSocket.new*", "*TCPSocket.open*"
     )) or
    (process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : (
     "*io.popen*", "*os.execute*"
    )) or
    (process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or 
    (process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or
    (process.name in ("rvim", "vim", "vimdiff", "rview", "view") and process.args == "-c" and process.args : "*socket*")
  ) and not (
      process.executable like (
        "/usr/bin/terraform", "/opt/homebrew/Cellar/git/*/libexec/git-core/git-remote-http", "/usr/local/aws-cli/aws", "/usr/bin/env",
        "/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core/git-remote-http", "/usr/lib/git-core/git-remote-https", "/usr/bin/ssh",
        "/home/linuxbrew/.linuxbrew/opt/git/libexec/git-core/git-remote-https", "/usr/lib/git-core/git-remote-https", "/usr/bin/git-remote-https",
        "/usr/bin/ssh", "/var/lib/docker/*/git-remote-https", "/usr/libexec/git-core/git", "/home/linuxbrew/.linuxbrew/*", "/usr/lib/git-core/git"
      ) or
      process.parent.executable like (
        "/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby", "/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby",
        "/usr/bin/git"
      )
    )
  ]
  [network where event.type == "start" and event.action == "connection_attempted" and (
    process.name like (
      "nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
      "nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm",
      "curl", "wget", "python*", "perl*", "ruby*", "lua*", "php*", "awk", "gawk", "mawk", "nawk", "rvim", "vim", "vimdiff", "rview",
      "view"
    ) or
    process.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*"
    )
  ) and not (
     destination.ip == null or destination.ip == "0.0.0.0" or
     cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8"
     )
   )
  ]
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.001"
name = "Web Protocols"
reference = "https://attack.mitre.org/techniques/T1071/001/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

Stages and Predicates

Ordered sequence: each step below must occur in order within 1m, correlated by process.entity_id.

Stage 1: `process`

[process where event.type == "start" and event.action == "exec" and not process.name == "node" and 
   (
     descendant of [process where event.type == "start" and event.action == "exec" and process.name == "node" and 
       (
         process.command_line : ("*post-install*", "*preinstall*") or 
         (process.args like "*/npm" and process.args in ("install", "update"))
      )] or 
     (process.parent.name == "node" and process.parent.command_line like ("*post-install*", "*preinstall*")) or 
     (process.parent.name == "node" and process.parent.args like "*/npm" and process.parent.args in ("install", "update"))
    ) and not (
      (process.name == "sh" and process.args == "-c" and process.args == "node") or
      process.args like ("rebuild", "build", "compile", "copyfiles*") or
      process.command_line in (
        "sh -c :; (node ./preinstall.js > /dev/null 2>&1 || true)",
        """sh -c  node -e "try{require('./_postinstall')}catch(e){}" || exit 0"""
      )
    ) and (
    process.name like (
      "nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
      "nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm"
    ) or
    process.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*"
    ) or
    (
       process.name == "curl" and process.args like "*http*" and process.args in ("-o", "--output") and
       process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
    ) or
    (
      process.name == "wget" and process.args like "*http*" and process.args in ("-O", "--output-document") and
      process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
    ) or
    (process.name : "python*" and process.args : "-c" and process.args : (
     "*import*pty*spawn*", "*import*subprocess*call*"
    )) or
    (process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : (
     "*exec*", "*system*"
    )) or
    (process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : (
     "*TCPSocket.new*", "*TCPSocket.open*"
     )) or
    (process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : (
     "*io.popen*", "*os.execute*"
    )) or
    (process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or 
    (process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or
    (process.name in ("rvim", "vim", "vimdiff", "rview", "view") and process.args == "-c" and process.args : "*socket*")
  ) and not (
      process.executable like (
        "/usr/bin/terraform", "/opt/homebrew/Cellar/git/*/libexec/git-core/git-remote-http", "/usr/local/aws-cli/aws", "/usr/bin/env",
        "/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core/git-remote-http", "/usr/lib/git-core/git-remote-https", "/usr/bin/ssh",
        "/home/linuxbrew/.linuxbrew/opt/git/libexec/git-core/git-remote-https", "/usr/lib/git-core/git-remote-https", "/usr/bin/git-remote-https",
        "/usr/bin/ssh", "/var/lib/docker/*/git-remote-https", "/usr/libexec/git-core/git", "/home/linuxbrew/.linuxbrew/*", "/usr/lib/git-core/git"
      ) or
      process.parent.executable like (
        "/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby", "/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby",
        "/usr/bin/git"
      )
    )
  ]

Stage 2: `network`

[network where event.type == "start" and event.action == "connection_attempted" and (
    process.name like (
      "nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
      "nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm",
      "curl", "wget", "python*", "perl*", "ruby*", "lua*", "php*", "awk", "gawk", "mawk", "nawk", "rvim", "vim", "vimdiff", "rview",
      "view"
    ) or
    process.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*"
    )
  ) and not (
     destination.ip == null or destination.ip == "0.0.0.0" or
     cidrmatch(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
       "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
       "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
       "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
       "FF00::/8"
     )
   )
  ]

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`process.args`	eq	`-c`	`excludes:process.args` `field:"process.args" value:"-c"`
`process.args`	eq	`node`	`excludes:process.args` `field:"process.args" value:"node"`
`process.name`	eq	`sh`	`excludes:process.name` `field:"process.name" value:"sh"`
`process.args`	wildcard	`rebuild`, `build`, `compile`, `copyfiles*`	`excludes:process.args`
`process.command_line`	in	`sh -c node -e "try{require('./_postinstall')}catch(e){}" \|\| exit 0`, `sh -c :; (node ./preinstall.js > /dev/null 2>&1 \|\| true)`	`excludes:process.command_line`
`process.executable`	wildcard	`/usr/bin/terraform`, `/opt/homebrew/Cellar/git//libexec/git-core/git-remote-http`, `/usr/local/aws-cli/aws`, `/usr/bin/env`, `/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core/git-remote-http`, `/usr/lib/git-core/git-remote-https`, `/usr/bin/ssh`, `/home/linuxbrew/.linuxbrew/opt/git/libexec/git-core/git-remote-https`, `/usr/lib/git-core/git-remote-https`, `/usr/bin/git-remote-https`, `/usr/bin/ssh`, `/var/lib/docker//git-remote-https`, `/usr/libexec/git-core/git`, `/home/linuxbrew/.linuxbrew/*`, `/usr/lib/git-core/git`	`excludes:process.executable`
`process.parent.executable`	wildcard	`/opt/homebrew/Library/Homebrew/vendor/portable-ruby//bin/ruby`, `/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby//bin/ruby`, `/usr/bin/git`	`excludes:process.parent.executable` `field:"process.parent.executable" value:"/opt/homebrew/Library/Homebrew/vendor/portable-ruby//bin/ruby"` `field:"process.parent.executable" value:"/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby//bin/ruby"` `field:"process.parent.executable" value:"/usr/bin/git"`
`process.name`	eq	`node`	`excludes:process.name` `field:"process.name" value:"node"`
`destination.ip`	cidr_match	`10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`, `192.0.0.0/24`, `192.0.0.0/29`, `192.0.0.8/32`, `192.0.0.9/32`, `192.0.0.10/32`, `192.0.0.170/32`, `192.0.0.171/32`, `192.0.2.0/24`, `192.31.196.0/24`, `192.52.193.0/24`, `192.168.0.0/16`, `192.88.99.0/24`, `224.0.0.0/4`, `100.64.0.0/10`, `192.175.48.0/24`, `198.18.0.0/15`, `198.51.100.0/24`, `203.0.113.0/24`, `240.0.0.0/4`, `::1`, `FE80::/10`, `FF00::/8`	`excludes:destination.ip`
`destination.ip`	eq	`0.0.0.0`	`excludes:destination.ip` `field:"destination.ip" value:"0.0.0.0"`
`destination.ip`	is_null	(no value, null check)	`excludes:destination.ip`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`event.action`	eq	`connection_attempted` `exec`	`field:"EventType" kind:eq`
`event.type`	eq	`start`	`field:"event.type" kind:eq value:"start"`
`process.args`	eq	`-c`	`field:"process.args" kind:eq value:"-c"`
`process.args`	in	`--output` `--output-document` `-O` `-o`	`field:"process.args" kind:in`
`process.args`	wildcard	`/bin/sh` `/inet/tcp/` `TCPSocket.new` `TCPSocket.open` `exec` `fsockopen` `http` `importptyspawn` `importsubprocesscall` `io.popen` `os.execute` `socket` `socket.tcp` `system` `-c` `-e` `-r` `-rsocket` `/dev/shm/` `/private/tmp/` `/tmp/` `/var/tmp/*`	`field:"process.args" kind:wildcard`
`process.executable`	wildcard	`./` `/boot/` `/dev/shm/` `/lost+found/` `/proc/` `/run/` `/sys/` `/tmp/` `/var/mail/` `/var/run/` `/var/tmp/` `/var/www/`	`field:"Image" kind:wildcard`
`process.name`	eq	`curl` `wget`	`field:"process_name" kind:eq`
`process.name`	in	`rview` `rvim` `view` `vim` `vimdiff`	`field:"process_name" kind:in`
`process.name`	wildcard	`awk` `busybox` `curl` `gawk` `lua` `mawk` `mkfifo` `nawk` `nc` `nc.openbsd` `nc.traditional` `ncat` `netcat` `netcat.openbsd` `netcat.traditional` `nohup` `perl` `php` `python` `ruby*` `rview` `rvim` `setsid` `socat` `telnet` `view` `vim` `vimdiff` `wget` `xterm`	`field:"process_name" kind:wildcard`
`process.parent.args`	in	`install` `update`	`field:"process.parent.args" kind:in`
`process.parent.args`	wildcard	`*/npm`	`field:"process.parent.args" kind:wildcard value:"*/npm"`
`process.parent.command_line`	wildcard	`post-install` `preinstall`	`field:"ParentCommandLine" kind:wildcard`
`process.parent.name`	eq	`node`	`field:"parent_process_name" kind:eq value:"node"`