Rule Library

Sigma Rules

Browse detections by severity and log source, with YAML and sample events one click away.

3,782Total

3,164Detection

474Emerging

141Hunting

Filters

Type

Severity

Status

Product

Linux Suspicious Child Process from Node.js - React2Shell

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

linuxprocess_creation

2025-12-05

highexperimentalEmerging Threat

Windows Suspicious Child Process from Node.js - React2Shell

Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync(). If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked. For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.

windowsprocess_creation2 samples

2025-12-05