Node.js Application Errors Involving child_process Indicative of RCE Attempts
Flags Node.js ERROR logs mentioning node:child_process, which may signal command execution and possible RCE risk.
- Product
- nodejs
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Node.js application error events that reference the node:child_process module, which can indicate attempts to trigger or exploit process execution paths. Such behavior matters because attackers may supply malicious input to reach unsafe command execution logic, leading to remote code execution risk. The detection relies on application error log telemetry containing module-related keywords associated with child_process.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Node.js Application Errors Involving child_process Indicative of RCE Attempts
id: b7fcf187-07a7-4fbf-9596-2ca0554c22d7
status: test
description: This rule flags Node.js application error events that reference the node:child_process module, which can indicate attempts to trigger or exploit process execution paths. Such behavior matters because attackers may supply malicious input to reach unsafe command execution logic, leading to remote code execution risk. The detection relies on application error log telemetry containing module-related keywords associated with child_process.
references:
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/nodejs/nodejs_rce_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: nodejs
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords:
- node:child_process
condition: keywords
falsepositives:
- Puppeteer invocation exceptions often contain child_process related errors, that doesn't necessarily mean that the app is vulnerable.
level: high
license: DRL-1.1
related:
- id: 97661d9d-2beb-4630-b423-68985291a8af
type: derived