Linux Suspicious Child Process Spawned by Node.js Parent (React2Shell Pattern)

title: Linux Suspicious Child Process Spawned by Node.js Parent (React2Shell Pattern)
id: d71933a4-07c3-465e-9c7c-b1f8cb2aab2c
related:
  - id: 271de298-cc0e-4842-acd8-079a0a99ea65
    type: similar
  - id: c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
    type: derived
status: experimental
description: This rule identifies Linux process creation events where a Node.js server process (parent executable ending in /node) spawns child processes matching common command-execution tooling and scripting indicators. Such behavior is often used during exploitation to run arbitrary system commands via Node.js child_process APIs. The detection relies on process creation telemetry, including the parent process image and command line, plus the child process image and command line contents for recognizable shell and system-recon/exfil utilities.
references:
  - https://github.com/msanft/CVE-2025-55182
  - https://nodejs.org/api/child_process.html#class-childprocess
  - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
  - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2025-12-05
tags:
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2025-55182
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /node
    ParentCommandLine|contains:
      - --experimental-https
      - --experimental-next-config-strip-types
      - /node_modules/next
      - next dev
      - next start
      - node_modules/.bin
      - react-scripts start
      - start-server.js
  selection_generic_child_img:
    - Image|endswith:
        - /busybox
        - /cat
        - /curl
        - /dash
        - /dig
        - /head
        - /id
        - /ifconfig
        - /ip
        - /java
        - /less
        - /lua
        - /more
        - /nc
        - /ncat
        - /netcat
        - /netstat
        - /nslookup
        - /perl
        - /ping
        - /python
        - /python2
        - /ruby
        - /socat
        - /tail
        - /wget
        - /whoami
    - Image|contains: /python
  selection_generic_child_cli:
    CommandLine|contains:
      - /dev/tcp/
      - /dev/udp/
      - /etc/hosts
      - /etc/passwd
      - /etc/shadow
      - base64
      - "cat "
      - curl
      - dig
      - ifconfig
      - IO::Socket::INET
      - java
      - "less "
      - lua
      - "mkfifo "
      - more
      - "nc "
      - ncat
      - netcat
      - netstat
      - nslookup
      - perl
      - php
      - ping
      - ps -ef
      - ps aux
      - python
      - rcat
      - ruby
      - sh -i 2>&1
      - -c id
      - socat
      - uname
      - wget
      - whoami
  selection_specific_sh:
    Image|endswith: /sh
  selection_specific_cli:
    Image|endswith: -c
  filter_main_default_shell_flag:
    Image|endswith: -c
  condition: selection_parent and ( 1 of selection_generic_* or (selection_specific_sh and not filter_main_default_shell_flag) or (all of selection_specific_* and selection_generic_child_cli) )
falsepositives:
  - Unknown
level: high
license: DRL-1.1