detection.wiki

Detection rules › Elastic

Payload Execution by Node.js Web Server

Source
github.com/elastic/protections-artifacts

This rule detects when a Node.js web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities to execute malicious payloads on Node.js web servers to gain/maintain access and to establish a command and control channel.

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Execution
Persistence
Lateral Movement
Command & Control

Rule body

[rule]
description = """
This rule detects when a Node.js web server executes a payload. Attackers may exploit RCE or file upload vulnerabilities
to execute malicious payloads on Node.js web servers to gain/maintain access and to establish a command and control
channel.
"""
id = "b982a098-f3c6-42d7-958a-86c46f06360b"
license = "Elastic License v2"
name = "Payload Execution by Node.js Web Server"
os_list = ["linux"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and
process.parent.name == "node" and process.parent.command_line like~ (
  "*next start*", "*--port*", "*PORT=*", "*HOST=*", "*0.0.0.0*", "*/dist/*.js*", "*/build/*.js*", "*/server/*.js*",
  "*/app/*.js*", "*/apps/*/*.js*", "*/index.js*", "*/main.js*", "*/srv/*", "*/opt/*", "*/var/www/*", "*n8n*"
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
  process.command_line like~ (

    /* Suspicious Paths */
    "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /run/*", "* /var/run/*",

    /* Encoding, Decoding & Piping */
    "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
    "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
    "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
    "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",

    /* Interpreter Execution */
    "*python -c*", "*python3 -c*", "*php -r*", "*perl -e*", "*ruby -e*", "*lua -e*", "*node -e *",

    /* Reverse Shells */
    "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
    "*mkfifo /tmp/*", 

    /* File Access */
    "*>*/etc/cron*", "*crontab*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*",
    "*/etc/passwd*", "*/etc/master.passwd*",

    /* Enumeration & Discovery */
    "*/etc/hosts*", "*/etc/resolv.conf*", "*/etc/hostname*", "*/etc/issue*", "*/etc/os-release*", "*lsb_release*",
    "*/proc/*/environ*", "*sudo -l*", "*/proc/*/cgroup*", "*dockerenv*", "*/proc/*/mountinfo*", "*printenv*",
    "*cat*.env *", "*getcap*", "*capsh*", "*find / *", "*netstat *",

    /* AWS Credentials */
    "*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
    "*.aws/credentials*", "*/.aws/config*",

    /* Azure Credentials */
    "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
    "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
    "*/run/secrets/azure/*",

    /* GCP Credentials */
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
    "*client_email*", "*private_key_id*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",

    /* Misc. Cloud */
    "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",

    /* Helpers */
    "*timeout *sh -c *", "*env *sh *-c*", "*exec -a*",

    /* Miscellaneous */
    "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", "*chpasswd*",
    "*<?php*?>*", "*kworker*",
    
    /* Decompression */
    "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
    
    /* Path Traversal */
    "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",

    /* File Upload/Download */
    "*pastebin.com*", "*transfer.sh*", "*bashupload.com*"
  ) or
  process.args in ("id", "whoami", "hostname")
) and
not (
  process.command_line like (
    "sh -c node -v || nodejs -v", "*./postinstall*", "*./_postinstall*", "/bin/sh -c lsb_release -sd",
    "*/etc/freepbx.conf*", "*betterme/image-processing-service-admin-frontend*", "/bin/sh -c exit 0 || node patches/*.js",
    """/bin/sh -c export LC_ALL=C; netstat -tunap | grep "ESTABLISHED\|SYN_SENT\|SYN_RECV\|FIN_WAIT1\|FIN_WAIT2\|TIME_WAIT\|CLOSE\|CLOSE_WAIT\|LAST_ACK\|LISTEN\|CLOSING\|UNKNOWN"; unset LC_ALL"""
  ) or
  process.parent.args like (
    "/opt/bitdefender/*", "/opt/cursor-agent/*", "/home/*/*", "/root/*", "/var/www/html/ext/.deloreanbuild",
    "/usr/lib/node_modules/openclaw/dist/index.js", "/opt/yarn*", "*anthropic-ai/claude-code/cli.js*",
    "/usr/bin/docker-builder", "/opt/jenkins/.nvm/versions/node/*/bin/npm", "/usr/local/renovate/node",
    "/opt/buildagent/work/*/node_modules/.bin/cypress", "/var/www/html/ext/node_modules/.bin/webpack",
    "/opt/containerbase/tools/node/*/bin/node", "/opt/*/bin/*/node_modules/.bin/bower", "/usr/local/bin/cursor-agent",
    "/mnt/*/.cursor-server/bin/linux-x64/*/node", "/scratch/*/home/.cursor-server/bin/linux-x64/*/node"
  ) or
  process.args like ("npx *", "node /var/www/html/ext/node_modules/.bin/webpack*", "grep* | awk*") or
  process.parent.executable like (
    "/user/*/.vscode-server/cli/servers/*/server/node", "/scratch/*/.vscode-server/cli/servers/*/server/node",
    "/users/*/.vscode-server/*/node", "/opt/code-server/*/lib/node", "/opt/jenkins/workspace/*/bin/node",
    "/scratch/user/*/.cursor-server/bin/linux-x64/*/node", "/*/.vscode-server/.cursor-server/bin/linux-x64/*/node"
  ) or
  process.working_directory == "/runner/_work/personify/personify/node_modules/snyk" or
  (process.command_line like "*REPO_NAME*" and process.parent.command_line like "node /usr/bin/n8n*") or
  (process.parent.command_line == "node /var/www/html/fs-ws-api/controller/cronJob.js" and process.command_line like "/bin/sh -c nc -zv 10.*") or
  (
    process.parent.executable == "/opt/liongard/node/bin/node" and
    process.command_line in (
     "/bin/sh -c cut -d: -f1 /etc/passwd", "/bin/sh -c hostname", "/bin/sh -c sudo cat /etc/ssh/sshd_config", "/bin/sh -c whoami"
    )
  ) or
  (
    process.executable like "/opt/node-*-linux-x64/bin/node" and
    process.working_directory == "/aplicaciones/backend/label-printing" and
    process.command_line like "/bin/sh -c python3 ./socket/main.py*"
  ) or
  (process.parent.executable like "/opt/actions-runner/_work/_tool/node/*/x64/bin/node" and process.command_line == "/bin/sh -c cat /etc/os-release") or
  (process.parent.executable == "/opt/node/bin/node" and process.parent.command_line == "node /opt/node/bin/npm ci") or
  (
    process.parent.executable like "/opt/hostedtoolcache/node/*/x64/bin/node" and
    process.parent.args in ("install", "ci") and
    process.parent.args like "/opt/hostedtoolcache/node/*"
  ) or
  (process.parent.executable like "/opt/plesk/node/*/bin/node" and process.parent.args in ("install", "ci"))
)
'''

min_endpoint_version = "8.2.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1505"
name = "Server Software Component"
reference = "https://attack.mitre.org/techniques/T1505/"
[[threat.technique.subtechnique]]
id = "T1505.003"
name = "Web Shell"
reference = "https://attack.mitre.org/techniques/T1505/003/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1210"
name = "Exploitation of Remote Services"
reference = "https://attack.mitre.org/techniques/T1210/"


[threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.2.0"

Stages and Predicates

Stage 1: process

process where event.type == "start" and event.action == "exec" and process.parent.interactive == false and
process.parent.name == "node" and process.parent.command_line like~ (
  "*next start*", "*--port*", "*PORT=*", "*HOST=*", "*0.0.0.0*", "*/dist/*.js*", "*/build/*.js*", "*/server/*.js*",
  "*/app/*.js*", "*/apps/*/*.js*", "*/index.js*", "*/main.js*", "*/srv/*", "*/opt/*", "*/var/www/*", "*n8n*"
) and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox") and
process.args in ("-c", "-cl", "-lc") and (
  process.command_line like~ (
    "* /tmp/* ", "* /var/tmp/* ", "* /dev/shm/*", "* /run/*", "* /var/run/*",
    "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
    "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
    "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
    "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
    "*python -c*", "*python3 -c*", "*php -r*", "*perl -e*", "*ruby -e*", "*lua -e*", "*node -e *",
    "*netcat *", "* nc *", "*ncat *", "*/dev/tcp*", "*/dev/udp/*", "*socat *", "*openssl*s_client *", "*stty*raw*-echo*",
    "*mkfifo /tmp/*",
    "*>*/etc/cron*", "*crontab*", "*/etc/ssh*", "*/home/*/.ssh/*", "*/root/.ssh*", "*~/.ssh/*", "*/etc/shadow*",
    "*/etc/passwd*", "*/etc/master.passwd*",
    "*/etc/hosts*", "*/etc/resolv.conf*", "*/etc/hostname*", "*/etc/issue*", "*/etc/os-release*", "*lsb_release*",
    "*/proc/*/environ*", "*sudo -l*", "*/proc/*/cgroup*", "*dockerenv*", "*/proc/*/mountinfo*", "*printenv*",
    "*cat*.env *", "*getcap*", "*capsh*", "*find / *", "*netstat *",
    "*aws_access_key_id*", "*aws_secret_access_key*", "*aws_session_token*", "*accesskeyid*", "*secretaccesskey*",
    "*.aws/credentials*", "*/.aws/config*",
    "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*", "*AZURE_FEDERATED_TOKEN_FILE*",
    "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*", "*/.azure/*",
    "*/run/secrets/azure/*",
    "*/.config/gcloud/*", "*application_default_credentials.json*", "*type: service_account*",
    "*client_email*", "*private_key_id*", "*/run/secrets/google/*", "*GOOGLE_APPLICATION_CREDENTIALS*",
    "*/.npmrc*", "*/secrets/kubernetes.io/serviceaccount/*",
    "*timeout *sh -c *", "*env *sh *-c*", "*exec -a*",
    "*chattr *", "*busybox *",  "*#!*", "*chmod +x *", "*chmod 777*", "*chpasswd*",
    "*<?php*?>*", "*kworker*",
    "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
    "*../../../*etc/*", "*/.../*", "*../../../*home/*/*", "*../../../*root/*",
    "*pastebin.com*", "*transfer.sh*", "*bashupload.com*"
  ) or
  process.args in ("id", "whoami", "hostname")
) and
not (
  process.command_line like (
    "sh -c node -v || nodejs -v", "*./postinstall*", "*./_postinstall*", "/bin/sh -c lsb_release -sd",
    "*/etc/freepbx.conf*", "*betterme/image-processing-service-admin-frontend*", "/bin/sh -c exit 0 || node patches/*.js",
    """/bin/sh -c export LC_ALL=C; netstat -tunap | grep "ESTABLISHED\|SYN_SENT\|SYN_RECV\|FIN_WAIT1\|FIN_WAIT2\|TIME_WAIT\|CLOSE\|CLOSE_WAIT\|LAST_ACK\|LISTEN\|CLOSING\|UNKNOWN"; unset LC_ALL"""
  ) or
  process.parent.args like (
    "/opt/bitdefender/*", "/opt/cursor-agent/*", "/home/*/*", "/root/*", "/var/www/html/ext/.deloreanbuild",
    "/usr/lib/node_modules/openclaw/dist/index.js", "/opt/yarn*", "*anthropic-ai/claude-code/cli.js*",
    "/usr/bin/docker-builder", "/opt/jenkins/.nvm/versions/node/*/bin/npm", "/usr/local/renovate/node",
    "/opt/buildagent/work/*/node_modules/.bin/cypress", "/var/www/html/ext/node_modules/.bin/webpack",
    "/opt/containerbase/tools/node/*/bin/node", "/opt/*/bin/*/node_modules/.bin/bower", "/usr/local/bin/cursor-agent",
    "/mnt/*/.cursor-server/bin/linux-x64/*/node", "/scratch/*/home/.cursor-server/bin/linux-x64/*/node"
  ) or
  process.args like ("npx *", "node /var/www/html/ext/node_modules/.bin/webpack*", "grep* | awk*") or
  process.parent.executable like (
    "/user/*/.vscode-server/cli/servers/*/server/node", "/scratch/*/.vscode-server/cli/servers/*/server/node",
    "/users/*/.vscode-server/*/node", "/opt/code-server/*/lib/node", "/opt/jenkins/workspace/*/bin/node",
    "/scratch/user/*/.cursor-server/bin/linux-x64/*/node", "/*/.vscode-server/.cursor-server/bin/linux-x64/*/node"
  ) or
  process.working_directory == "/runner/_work/personify/personify/node_modules/snyk" or
  (process.command_line like "*REPO_NAME*" and process.parent.command_line like "node /usr/bin/n8n*") or
  (process.parent.command_line == "node /var/www/html/fs-ws-api/controller/cronJob.js" and process.command_line like "/bin/sh -c nc -zv 10.*") or
  (
    process.parent.executable == "/opt/liongard/node/bin/node" and
    process.command_line in (
     "/bin/sh -c cut -d: -f1 /etc/passwd", "/bin/sh -c hostname", "/bin/sh -c sudo cat /etc/ssh/sshd_config", "/bin/sh -c whoami"
    )
  ) or
  (
    process.executable like "/opt/node-*-linux-x64/bin/node" and
    process.working_directory == "/aplicaciones/backend/label-printing" and
    process.command_line like "/bin/sh -c python3 ./socket/main.py*"
  ) or
  (process.parent.executable like "/opt/actions-runner/_work/_tool/node/*/x64/bin/node" and process.command_line == "/bin/sh -c cat /etc/os-release") or
  (process.parent.executable == "/opt/node/bin/node" and process.parent.command_line == "node /opt/node/bin/npm ci") or
  (
    process.parent.executable like "/opt/hostedtoolcache/node/*/x64/bin/node" and
    process.parent.args in ("install", "ci") and
    process.parent.args like "/opt/hostedtoolcache/node/*"
  ) or
  (process.parent.executable like "/opt/plesk/node/*/bin/node" and process.parent.args in ("install", "ci"))
)

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
process.command_lineeq/bin/sh -c cat /etc/os-releaseexcludes:process.command_line field:"process.command_line" value:"/bin/sh -c cat /etc/os-release"
process.parent.executablewildcard/opt/actions-runner/_work/_tool/node/*/x64/bin/nodeexcludes:process.parent.executable field:"process.parent.executable" value:"/opt/actions-runner/_work/_tool/node/*/x64/bin/node"
process.command_linein/bin/sh -c cut -d: -f1 /etc/passwd, /bin/sh -c hostname, /bin/sh -c sudo cat /etc/ssh/sshd_config, /bin/sh -c whoamiexcludes:process.command_line
process.parent.executableeq/opt/liongard/node/bin/nodeexcludes:process.parent.executable field:"process.parent.executable" value:"/opt/liongard/node/bin/node"
process.command_linematchREPO_NAMEexcludes:process.command_line field:"process.command_line" value:"REPO_NAME"
process.parent.command_linestarts_withnode /usr/bin/n8nexcludes:process.parent.command_line field:"process.parent.command_line" value:"node /usr/bin/n8n"
process.command_linestarts_with/bin/sh -c nc -zv 10.excludes:process.command_line field:"process.command_line" value:"/bin/sh -c nc -zv 10."
process.parent.command_lineeqnode /var/www/html/fs-ws-api/controller/cronJob.jsexcludes:process.parent.command_line field:"process.parent.command_line" value:"node /var/www/html/fs-ws-api/controller/cronJob.js"
process.command_linestarts_with/bin/sh -c python3 ./socket/main.pyexcludes:process.command_line field:"process.command_line" value:"/bin/sh -c python3 ./socket/main.py"
process.executablewildcard/opt/node-*-linux-x64/bin/nodeexcludes:process.executable field:"process.executable" value:"/opt/node-*-linux-x64/bin/node"
process.working_directoryeq/aplicaciones/backend/label-printingexcludes:process.working_directory field:"process.working_directory" value:"/aplicaciones/backend/label-printing"
process.parent.argsinci, installexcludes:process.parent.args field:"process.parent.args" value:"ci" field:"process.parent.args" value:"install"
process.parent.argsstarts_with/opt/hostedtoolcache/node/excludes:process.parent.args field:"process.parent.args" value:"/opt/hostedtoolcache/node/"
process.parent.executablewildcard/opt/hostedtoolcache/node/*/x64/bin/nodeexcludes:process.parent.executable field:"process.parent.executable" value:"/opt/hostedtoolcache/node/*/x64/bin/node"
process.parent.executablewildcard/opt/plesk/node/*/bin/nodeexcludes:process.parent.executable field:"process.parent.executable" value:"/opt/plesk/node/*/bin/node"
process.parent.command_lineeqnode /opt/node/bin/npm ciexcludes:process.parent.command_line field:"process.parent.command_line" value:"node /opt/node/bin/npm ci"
process.parent.executableeq/opt/node/bin/nodeexcludes:process.parent.executable field:"process.parent.executable" value:"/opt/node/bin/node"
process.argswildcardnpx *, node /var/www/html/ext/node_modules/.bin/webpack*, grep* | awk*excludes:process.args field:"process.args" value:"npx *" field:"process.args" value:"node /var/www/html/ext/node_modules/.bin/webpack*" field:"process.args" value:"grep* | awk*"
process.command_linewildcardsh -c node -v || nodejs -v, *./postinstall*, *./_postinstall*, /bin/sh -c lsb_release -sd, */etc/freepbx.conf*, *betterme/image-processing-service-admin-frontend*, /bin/sh -c exit 0 || node patches/*.js, /bin/sh -c export LC_ALL=C; netstat -tunap | grep "ESTABLISHED\|SYN_SENT\|SYN_RECV\|FIN_WAIT1\|FIN_WAIT2\|TIME_WAIT\|CLOSE\|CLOSE_WAIT\|LAST_ACK\|LISTEN\|CLOSING\|UNKNOWN"; unset LC_ALLexcludes:process.command_line
process.parent.argswildcard/opt/bitdefender/*, /opt/cursor-agent/*, /home/*/*, /root/*, /var/www/html/ext/.deloreanbuild, /usr/lib/node_modules/openclaw/dist/index.js, /opt/yarn*, *anthropic-ai/claude-code/cli.js*, /usr/bin/docker-builder, /opt/jenkins/.nvm/versions/node/*/bin/npm, /usr/local/renovate/node, /opt/buildagent/work/*/node_modules/.bin/cypress, /var/www/html/ext/node_modules/.bin/webpack, /opt/containerbase/tools/node/*/bin/node, /opt/*/bin/*/node_modules/.bin/bower, /usr/local/bin/cursor-agent, /mnt/*/.cursor-server/bin/linux-x64/*/node, /scratch/*/home/.cursor-server/bin/linux-x64/*/nodeexcludes:process.parent.args
process.parent.executablewildcard/user/*/.vscode-server/cli/servers/*/server/node, /scratch/*/.vscode-server/cli/servers/*/server/node, /users/*/.vscode-server/*/node, /opt/code-server/*/lib/node, /opt/jenkins/workspace/*/bin/node, /scratch/user/*/.cursor-server/bin/linux-x64/*/node, /*/.vscode-server/.cursor-server/bin/linux-x64/*/nodeexcludes:process.parent.executable
process.working_directoryeq/runner/_work/personify/personify/node_modules/snykexcludes:process.working_directory field:"process.working_directory" value:"/runner/_work/personify/personify/node_modules/snyk"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
event.actioneq
  • exec
field:"EventType" kind:eq value:"exec"
event.typeeq
  • start
field:"event.type" kind:eq value:"start"
process.argsin
  • -c
  • -cl
  • -lc
  • hostname
  • id
  • whoami
field:"process.args" kind:in
process.command_linewildcard
  • * /dev/shm/*
  • * /run/*
  • * /tmp/*
  • * /var/run/*
  • * /var/tmp/*
  • * nc *
  • *#!*
  • *../../../*etc/*
  • *../../../*home/*/*
  • *../../../*root/*
  • *.aws/credentials*
  • */.../*
  • */.aws/config*
  • */.azure/*
  • */.config/gcloud/*
  • */.npmrc*
  • */dev/tcp*
  • */dev/udp/*
  • */etc/hostname*
  • */etc/hosts*
  • */etc/issue*
  • */etc/master.passwd*
  • */etc/os-release*
  • */etc/passwd*
  • */etc/resolv.conf*
  • */etc/shadow*
  • */etc/ssh*
  • */home/*/.ssh/*
  • */proc/*/cgroup*
  • */proc/*/environ*
  • */proc/*/mountinfo*
  • */root/.ssh*
  • */run/secrets/azure/*
  • */run/secrets/google/*
  • */secrets/kubernetes.io/serviceaccount/*
  • *<?php*?>*
  • *>*/etc/cron*
  • *AZURE_CLIENT_ID*
  • *AZURE_CLIENT_SECRET*
  • *AZURE_FEDERATED_TOKEN_FILE*
  • +84 more values (see full rule source)
field:"CommandLine" kind:wildcard
process.namein
  • bash
  • busybox
  • csh
  • dash
  • fish
  • ksh
  • mksh
  • sh
  • tcsh
  • zsh
field:"process_name" kind:in
process.parent.command_linewildcard
  • *--port*
  • */app/*.js*
  • */apps/*/*.js*
  • */build/*.js*
  • */dist/*.js*
  • */index.js*
  • */main.js*
  • */opt/*
  • */server/*.js*
  • */srv/*
  • */var/www/*
  • *0.0.0.0*
  • *HOST=*
  • *PORT=*
  • *n8n*
  • *next start*
field:"ParentCommandLine" kind:wildcard
process.parent.interactiveeq
  • false transforms: boolean
field:"process.parent.interactive" kind:eq value:"false"
process.parent.nameeq
  • node
field:"parent_process_name" kind:eq value:"node"