Potential Arbitrary Code Execution Via Node.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•66

Detects the execution of 'node.exe' with command-line arguments indicative of arbitrary code execution, specifically looking for evaluation flags ('-e', '--eval') combined with patterns suggesting a reverse shell (e.g., '.exec(', 'net.socket', '.connect', 'child_process'). This behavior has been observed in attacks leveraging vulnerabilities like Log4j.