huntrule

Linux process creation: suspicious child processes launched by Node.js server command execution

Flags Linux processes where a Node.js server child-process pattern launches suspicious shell/command tooling.

FreeReviewedSigma · High · v5
Product
linux
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published
2025-12-05
Updated
2026-07-31
AnalysisDetection
title: "Linux process creation: suspicious child processes launched by Node.js server command execution"
id: d71933a4-07c3-465e-9c7c-b1f8cb2aab2c
related:
  - id: 271de298-cc0e-4842-acd8-079a0a99ea65
    type: similar
  - id: c70834fa-fb9d-4aa0-9e7d-45ceed36f3f7
    type: derived
status: experimental
description: This rule flags Linux process creation events where a Node.js parent process associated with common Next/React server startup patterns spawns child processes indicative of command execution. Such activity is relevant because it can reflect exploitation where Node.js child_process APIs are abused to run system utilities or interpreter-based payloads. Detection relies on process creation telemetry including the parent image/command line and the child process image and command-line substrings consistent with shell, networking, and file/identity discovery tools.
references:
  - https://github.com/msanft/CVE-2025-55182
  - https://nodejs.org/api/child_process.html#class-childprocess
  - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
  - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali, Huntrule Team
date: 2025-12-05
tags:
  - attack.execution
  - attack.t1059
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2025-55182
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /node
    ParentCommandLine|contains:
      - --experimental-https
      - --experimental-next-config-strip-types
      - /node_modules/next
      - next dev
      - next start
      - node_modules/.bin
      - react-scripts start
      - start-server.js
  selection_generic_child_img:
    - Image|endswith:
        - /busybox
        - /cat
        - /curl
        - /dash
        - /dig
        - /head
        - /id
        - /ifconfig
        - /ip
        - /java
        - /less
        - /lua
        - /more
        - /nc
        - /ncat
        - /netcat
        - /netstat
        - /nslookup
        - /perl
        - /ping
        - /python
        - /python2
        - /ruby
        - /socat
        - /tail
        - /wget
        - /whoami
    - Image|contains: /python
  selection_generic_child_cli:
    CommandLine|contains:
      - /dev/tcp/
      - /dev/udp/
      - /etc/hosts
      - /etc/passwd
      - /etc/shadow
      - base64
      - "cat "
      - curl
      - dig
      - ifconfig
      - IO::Socket::INET
      - java
      - "less "
      - lua
      - "mkfifo "
      - more
      - "nc "
      - ncat
      - netcat
      - netstat
      - nslookup
      - perl
      - php
      - ping
      - ps -ef
      - ps aux
      - python
      - rcat
      - ruby
      - sh -i 2>&1
      - -c id
      - socat
      - uname
      - wget
      - whoami
  selection_specific_sh:
    Image|endswith: /sh
  selection_specific_cli:
    Image|endswith: -c
  filter_main_default_shell_flag:
    Image|endswith: -c
  condition: selection_parent and ( 1 of selection_generic_* or (selection_specific_sh and not filter_main_default_shell_flag) or (all of selection_specific_* and selection_generic_child_cli) )
falsepositives:
  - Unknown
level: high
license: DRL-1.1