{"id":"6640f31c-01ad-49b5-beb5-83498a5cd8bd","title":"Potential Arbitrary Code Execution Via Node.EXE","description":"Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-09","modified":"2023-02-03","tags":["attack.execution","attack.stealth","attack.t1127"],"technique_ids":["T1127"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html","https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return","https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/","https://nodejs.org/api/cli.html"],"source_path":"rules/windows/process_creation/proc_creation_win_node_abuse.yml","source_sha256":"ececbcaa16d2cce77a642a813281c63d874702e3b6b5f5a3e08f5541806482a3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_node_abuse.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Arbitrary Code Execution Via Node.EXE\nid: 6640f31c-01ad-49b5-beb5-83498a5cd8bd\nstatus: test\ndescription: Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc\nreferences:\n    - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html\n    - https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return\n    - https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/\n    - https://nodejs.org/api/cli.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-09\nmodified: 2023-02-03\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1127\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_main:\n        Image|endswith: '\\node.exe'\n        CommandLine|contains:\n            - ' -e '\n            - ' --eval '\n    # Add more pattern of abuse as actions\n    selection_action_reverse_shell:\n        CommandLine|contains|all:\n            - '.exec('\n            - 'net.socket'\n            - '.connect'\n            - 'child_process'\n    condition: selection_main and 1 of selection_action_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1127","id":"T1127","name":"Trusted Developer Utilities Proxy Execution","page":"techniques/enterprise/T1127/"}],"data_path":"data/detection-rules/6640f31c-01ad-49b5-beb5-83498a5cd8bd.json","kind":"sigma"}