Node.js Application Error Logs Indicating Potential RCE via child_process

Flags Node.js ERROR logs mentioning node:child_process, which may signal command execution and possible RCE risk.

FreeUnreviewedSigmahighv1

node-js-application-error-logs-indicating-potential-rce-via-child-process-97661d9d

title: Node.js Application Error Logs Indicating Potential RCE via child_process
id: b7fcf187-07a7-4fbf-9596-2ca0554c22d7
status: test
description: This rule flags Node.js application error messages that reference the node:child_process module, which can indicate attempts to execute commands based on user-controlled input. Such behavior matters because it may reflect exploitation paths toward remote code execution. The detection relies on application error log text containing the specified child_process keyword.
references:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/nodejs/nodejs_rce_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: nodejs
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
  keywords:
    - node:child_process
  condition: keywords
falsepositives:
  - Puppeteer invocation exceptions often contain child_process related errors, that doesn't necessarily mean that the app is vulnerable.
level: high
license: DRL-1.1
related:
  - id: 97661d9d-2beb-4630-b423-68985291a8af
    type: derived

What it detects

This rule flags Node.js application error messages that reference the node:child_process module, which can indicate attempts to execute commands based on user-controlled input. Such behavior matters because it may reflect exploitation paths toward remote code execution. The detection relies on application error log text containing the specified child_process keyword.

Known false positives

Puppeteer invocation exceptions often contain child_process related errors, that doesn't necessarily mean that the app is vulnerable.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.