Linux process creation: suspicious child processes launched by Node.js server command execution

Flags Linux processes where a Node.js server child-process pattern launches suspicious shell/command tooling.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2025-12-05
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1059Command and Scripting Interpreter
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process creation events where a Node.js parent process associated with common Next/React server startup patterns spawns child processes indicative of command execution. Such activity is relevant because it can reflect exploitation where Node.js child_process APIs are abused to run system utilities or interpreter-based payloads. Detection relies on process creation telemetry including the parent image/command line and the child process image and command-line substrings consistent with shell, networking, and file/identity discovery tools.

Reporting behind it

Related detections9 linkedT1059 — drag to rearrange

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Suspicious Reconnaissance and Payload Download by Node Web Process

Malicious Text4Shell Apache Commons Text Interpolation Payload in HTTP Request

Possible Apache ActiveMQ RCE via Jolokia addNetworkConnector (via webserver)

Possible LiteLLM Unauthenticated Command Execution via MCP Test Endpoints (via webserver)

Possible Ivanti Cloud Services Appliance Command Injection via datetime.php (via webserver)

Possible Log4Shell Exploitation via Java Spawning Shell or Download Utility

Possible Ivanti Pulse Connect Secure Command Injection via License Keys-Status Endpoint (via webserver)

Possible Craft CMS RCE via Query-String CLI Option Injection

Linux process creation: suspicious child processes launched by Node.js server command execution

Pivot detection · T1059 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-suspicious-child-process-spawned-by-node-js-parent-react2shell-pattern-c70834fa

title: "Linux process creation: suspicious child processes launched by Node.js server command execution"
id: d71933a4-07c3-465e-9c7c-b1f8cb2aab2c
related:
  - id: 271de298-cc0e-4842-acd8-079a0a99ea65
    type: similar
  - id: c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
    type: derived
status: experimental
description: This rule flags Linux process creation events where a Node.js parent process associated with common Next/React server startup patterns spawns child processes indicative of command execution. Such activity is relevant because it can reflect exploitation where Node.js child_process APIs are abused to run system utilities or interpreter-based payloads. Detection relies on process creation telemetry including the parent image/command line and the child process image and command-line substrings consistent with shell, networking, and file/identity discovery tools.
references:
  - https://github.com/msanft/CVE-2025-55182
  - https://nodejs.org/api/child_process.html#class-childprocess
  - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
  - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2025-12-05
tags:
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2025-55182
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /node
    ParentCommandLine|contains:
      - --experimental-https
      - --experimental-next-config-strip-types
      - /node_modules/next
      - next dev
      - next start
      - node_modules/.bin
      - react-scripts start
      - start-server.js
  selection_generic_child_img:
    - Image|endswith:
        - /busybox
        - /cat
        - /curl
        - /dash
        - /dig
        - /head
        - /id
        - /ifconfig
        - /ip
        - /java
        - /less
        - /lua
        - /more
        - /nc
        - /ncat
        - /netcat
        - /netstat
        - /nslookup
        - /perl
        - /ping
        - /python
        - /python2
        - /ruby
        - /socat
        - /tail
        - /wget
        - /whoami
    - Image|contains: /python
  selection_generic_child_cli:
    CommandLine|contains:
      - /dev/tcp/
      - /dev/udp/
      - /etc/hosts
      - /etc/passwd
      - /etc/shadow
      - base64
      - "cat "
      - curl
      - dig
      - ifconfig
      - IO::Socket::INET
      - java
      - "less "
      - lua
      - "mkfifo "
      - more
      - "nc "
      - ncat
      - netcat
      - netstat
      - nslookup
      - perl
      - php
      - ping
      - ps -ef
      - ps aux
      - python
      - rcat
      - ruby
      - sh -i 2>&1
      - -c id
      - socat
      - uname
      - wget
      - whoami
  selection_specific_sh:
    Image|endswith: /sh
  selection_specific_cli:
    Image|endswith: -c
  filter_main_default_shell_flag:
    Image|endswith: -c
  condition: selection_parent and ( 1 of selection_generic_* or (selection_specific_sh and not filter_main_default_shell_flag) or (all of selection_specific_* and selection_generic_child_cli) )
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL