Potential Arbitrary Code Execution Via Node.EXE

Title: Potential Arbitrary Code Execution Via Node.EXE
Status: test
Description:Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
References:
  -http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  -https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return
  -https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/
  -https://nodejs.org/api/cli.html
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
modified:2023-02-03
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1127'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_main:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      -' -e '
      -' --eval '

  selection_action_reverse_shell:
    CommandLine|contains|all:
      -'.exec('
      -'net.socket'
      -'.connect'
      -'child_process'

  condition:selection_main and 1 of selection_action_*
Falsepositives:
  -Unlikely
Level: high