Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
6
5
4
3
2
Contributors
6
4
4
2
1
Categories
15
12
8
6
4
Platforms
10
9
7
2
Products / Services
6
6
6
6
5
MITRE Techniques
15
9
7
6
6
CVEs
71
71
64
58
49
22
IDS Classtypes
6
IDS Protocols
6
This analytic detects Windows processes such as cmd.exe, PowerShell, and common Windows LOLBINs being spawned by React or Next.js application servers.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
Detects the execution of PowerShell with command-line arguments containing keywords indicative of in-memory download and execution, such as '-enc' or '-EncodedCommand' used in conjunction with 'IEX' (Invoke-Expression) or 'DownloadString'. This pattern is a common TTP for initial access and second-stage payload delivery, and was observed in the exploitation of CVE-2025-55182 (React2Shell).
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects exploitation attempts and worm-like scanning behavior targeting Next.js applications, characteristic of the EtherRAT malware. The rule identifies web requests with the 'x-middleware-subrequest' header (CVE-2025-29927) or scanning of sensitive paths like '/_next/data/' from internal sources.
Detects the execution of PowerShell with command-line arguments containing keywords indicative of in-memory download and execution, such as '-enc' or '-EncodedCommand' used in conjunction with 'IEX' (Invoke-Expression) or 'DownloadString'. This pattern is a common TTP for initial access and second-stage payload delivery, and was observed in the exploitation of CVE-2025-55182 (React2Shell).
Detects the execution of Node.js with the '-e' flag, which evaluates a string as JavaScript. This technique is used by the EtherRAT implant for fileless execution, particularly for privilege escalation attempts.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.
Detects React2Shell exploitation attempts via prototype pollution and Node.js
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
gadget invocation. Covers vulnerability scanning, gadget testing, and active
RCE exploitation.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.
Detects attempts to exploit CVE-2025-55182 (Next.js/React) via Server Actions. Target is identified by the 'Next-Action' header or 'RSC' markers, combined with JSON prototype pollution vectors in the body.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) utilizing data from the Imperva WAF leveraging vm#, child_process#, util_#, & fs_# indicators.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
Detects installed Next.js versions < 16.0.7 vulnerable to CVE-2025-55182 (React Flight RCE)
This rule detects a possible Remote Code Execution (RCE) attempt targeting a React application, specifically exploiting CVE-2025-55182. It looks for inbound HTTP POST requests containing 'child_process' and 'response' and 'Sync' in the request body, along with specific HTTP headers ('Next-Action', 'rsc-action-id', or 'text/x-component'). The presence of 'child_process' suggests an attempt to execute system commands.
Detects the spawning of a shell process from a Node.js or Next.js server process, which is a strong indicator of post-exploitation activity following a Remote Code Execution (RCE) vulnerability like CVE-2025-55182 or CVE-2025-66478.
Detects attempts to exploit CVE-2025-55182 by injecting prototype pollution vectors ("__proto__", "constructor") into React Server Component (RSC) or Next.js Server Action requests. This vulnerability allows for Remote Code Execution via object serialization flaws.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
Page 1 of 2