Potential Arbitrary Code Execution Via Node.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1127` Trusted Developer Utilities Proxy Execution
Stealth	`T1127` Trusted Developer Utilities Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential Arbitrary Code Execution Via Node.EXE
id: 6640f31c-01ad-49b5-beb5-83498a5cd8bd
status: test
description: Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
references:
    - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
    - https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return
    - https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/
    - https://nodejs.org/api/cli.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-09
modified: 2023-02-03
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
logsource:
    category: process_creation
    product: windows
detection:
    selection_main:
        Image|endswith: '\node.exe'
        CommandLine|contains:
            - ' -e '
            - ' --eval '
    # Add more pattern of abuse as actions
    selection_action_reverse_shell:
        CommandLine|contains|all:
            - '.exec('
            - 'net.socket'
            - '.connect'
            - 'child_process'
    condition: selection_main and 1 of selection_action_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection_main and 1 of selection_action_*

Stage 1: `selection_main`

selection_main:
    Image|endswith: '\node.exe'
    CommandLine|contains:
        - ' -e '
        - ' --eval '

Stage 2: `selection_action_reverse_shell`

selection_action_reverse_shell:
    CommandLine|contains|all:
        - '.exec('
        - 'net.socket'
        - '.connect'
        - 'child_process'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--eval` `-e` corpus 17 (sigma 14, elastic 3) `.connect` corpus 2 (sigma 2) `.exec(` `child_process` `net.socket`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\node.exe` corpus 6 (sigma 6)	`field:"Image" kind:ends_with value:"\node.exe"`