EtherRAT React2Shell Exploitation and Fileless Execution
This rule detects suspicious Node.js activity potentially related to EtherRAT's React2Shell exploitation (CVE-2025-55182) and fileless execution. It looks for combinations of fileless Node.js execution patterns (using -e, --eval, or --input-type=module with common modules like require, import, fetch, http) alongside Ethereum RPC queries (eth_call, eth_getStorageAt, infura.io, alchemy.com, cloudflare-eth). It also identifies scenarios where Node.js is downloaded from nodejs.org and then persistence mechanisms are set up via .bashrc, .profile, .bash_profile, systemd, or cron. Another detection path involves fileless Node.js execution combined with systemd or cron persistence. The rule specifically targets Linux environments and process creation events.
Sigma
