Linux process creation: suspicious child processes launched by Node.js server command execution

Flags Linux processes where a Node.js server child-process pattern launches suspicious shell/command tooling.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2025-12-05
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process creation events where a Node.js parent process associated with common Next/React server startup patterns spawns child processes indicative of command execution. Such activity is relevant because it can reflect exploitation where Node.js child_process APIs are abused to run system utilities or interpreter-based payloads. Detection relies on process creation telemetry including the parent image/command line and the child process image and command-line substrings consistent with shell, networking, and file/identity discovery tools.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

Possible Craft CMS RCE via Query-String CLI Option Injection

Possible Aspera Faspex Pre-Auth RCE via YAML Deserialization in package_relay (via webserver)

Possible Sitecore Pre-Auth RCE via Report.ashx Insecure Deserialization (via webserver)

Possible WatchGuard Pre-Auth RCE via agent login XML-RPC CVE-2022-26318

Possible Oracle Opera CGI Webshell Command Execution via operabin

Suspicious PHP Stream Wrapper in Query-String CLI Argument

Possible Sitecore Experience Platform Pre-Auth RCE via TypeConfuseDelegate Gadget (via webserver)

Possible SSTI Remote Command Execution from Web Application Process

Linux process creation: suspicious child processes launched by Node.js server command execution

Pivot detection · T1059 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-suspicious-child-process-spawned-by-node-js-parent-react2shell-pattern-c70834fa

title: "Linux process creation: suspicious child processes launched by Node.js server command execution"
id: d71933a4-07c3-465e-9c7c-b1f8cb2aab2c
related:
  - id: 271de298-cc0e-4842-acd8-079a0a99ea65
    type: similar
  - id: c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
    type: derived
status: experimental
description: This rule flags Linux process creation events where a Node.js parent process associated with common Next/React server startup patterns spawns child processes indicative of command execution. Such activity is relevant because it can reflect exploitation where Node.js child_process APIs are abused to run system utilities or interpreter-based payloads. Detection relies on process creation telemetry including the parent image/command line and the child process image and command-line substrings consistent with shell, networking, and file/identity discovery tools.
references:
  - https://github.com/msanft/CVE-2025-55182
  - https://nodejs.org/api/child_process.html#class-childprocess
  - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
  - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2025-12-05
tags:
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2025-55182
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /node
    ParentCommandLine|contains:
      - --experimental-https
      - --experimental-next-config-strip-types
      - /node_modules/next
      - next dev
      - next start
      - node_modules/.bin
      - react-scripts start
      - start-server.js
  selection_generic_child_img:
    - Image|endswith:
        - /busybox
        - /cat
        - /curl
        - /dash
        - /dig
        - /head
        - /id
        - /ifconfig
        - /ip
        - /java
        - /less
        - /lua
        - /more
        - /nc
        - /ncat
        - /netcat
        - /netstat
        - /nslookup
        - /perl
        - /ping
        - /python
        - /python2
        - /ruby
        - /socat
        - /tail
        - /wget
        - /whoami
    - Image|contains: /python
  selection_generic_child_cli:
    CommandLine|contains:
      - /dev/tcp/
      - /dev/udp/
      - /etc/hosts
      - /etc/passwd
      - /etc/shadow
      - base64
      - "cat "
      - curl
      - dig
      - ifconfig
      - IO::Socket::INET
      - java
      - "less "
      - lua
      - "mkfifo "
      - more
      - "nc "
      - ncat
      - netcat
      - netstat
      - nslookup
      - perl
      - php
      - ping
      - ps -ef
      - ps aux
      - python
      - rcat
      - ruby
      - sh -i 2>&1
      - -c id
      - socat
      - uname
      - wget
      - whoami
  selection_specific_sh:
    Image|endswith: /sh
  selection_specific_cli:
    Image|endswith: -c
  filter_main_default_shell_flag:
    Image|endswith: -c
  condition: selection_parent and ( 1 of selection_generic_* or (selection_specific_sh and not filter_main_default_shell_flag) or (all of selection_specific_* and selection_generic_child_cli) )
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL