Prettier eslint-config-prettier Embedded Malicious Code (CVE-2025-54313)

union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where TimeGenerated > ago(30d)
| where (
    (ActionType == "ProcessCreated" and (InitiatingProcessCommandLine has "eslint-config-prettier" or ProcessCommandLine has "eslint-config-prettier"))
    or (ActionType == "FileCreated" and FolderPath has "eslint-config-prettier" and FileName matches regex @"(?i)\.(sh|ps1|cmd|bat|exe|dll)$")
    or (ActionType == "NetworkConnectionInitiated" and InitiatingProcessFileName in~ ("node", "npm", "npx") and not(RemoteUrl has_any ("registry.npmjs.org", "localhost", "127.0.0.1")))
)
| extend Risk = case(
    ActionType == "NetworkConnectionInitiated" and InitiatingProcessFileName in~ ("node","npm"), "High",
    ActionType == "FileCreated" and FileName matches regex @"(?i)\.(exe|dll)$", "Critical",
    "Medium"
)
| project TimeGenerated, DeviceName, AccountName, ActionType, InitiatingProcessCommandLine, ProcessCommandLine, RemoteUrl, FolderPath, FileName, Risk
| sort by TimeGenerated desc

index=* sourcetype IN ("xmlwineventlog", "WinEventLog:Security", "linux_secure", "osquery:results", "endpoint", "npm_audit")
| eval cmd=coalesce(CommandLine, command, process)
| where (match(cmd, "(?i)eslint-config-prettier") OR match(EventName, "(?i)eslint-config-prettier"))
   OR (sourcetype="endpoint" AND match(file_path, "(?i)eslint-config-prettier") AND match(file_name, "(?i)\.(sh|ps1|bat|exe|dll)$"))
   OR (sourcetype IN ("stream:tcp","stream:udp") AND match(app, "(?i)(node|npm)") AND NOT match(dest_host, "(registry\.npmjs\.org|localhost|127\.0\.0\.1)"))
| eval severity=case(
    match(file_name, "(?i)\.(exe|dll)$"), "critical",
    sourcetype IN ("stream:tcp","stream:udp"), "high",
    true(), "medium"
  )
| table _time, host, user, cmd, file_path, file_name, dest_host, dest_port, severity
| sort - _time

sequence by host.name with maxspan=5m
  [process where event.action == "start"
    and process.name in ("node", "npm", "npx", "sh", "bash", "powershell.exe", "cmd.exe")
    and (process.command_line like "*eslint-config-prettier*" or process.parent.command_line like "*eslint-config-prettier*")]
  [any where event.category in ("network", "file")
    and (
      (event.category == "network" and not network.destination.domain like "*npmjs.org*" and not network.destination.ip like "127.*")
      or (event.category == "file" and file.extension in ("exe", "dll", "sh", "ps1", "bat"))
    )
  ]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS 'Event Time', sourceip, destinationip, destinationport, username, "Command" AS cmd, "File Path" AS file_path, LOGSOURCENAME(logsourceid) AS log_source
FROM events
WHERE LAST 30 DAYS
AND (
  (LOWER("Command") ILIKE '%eslint-config-prettier%')
  OR (LOWER("File Path") ILIKE '%eslint-config-prettier%' AND (LOWER("File Path") ILIKE '%.exe' OR LOWER("File Path") ILIKE '%.dll' OR LOWER("File Path") ILIKE '%.sh'))
  OR ("Application" ILIKE '%node%' AND destinationip NOT ILIKE '127.0.0.%' AND destinationport NOT IN (80, 443) AND CATEGORYNAME(category) ILIKE '%network%')
)
ORDER BY starttime DESC

_sourceCategory=* ("eslint-config-prettier" OR "npm install")
| parse regex "(?i)(?P<pkg_ref>eslint-config-prettier[^\s]*)" nodrop
| parse regex "(?P<file_ext>\.(exe|dll|sh|ps1|bat))" nodrop
| parse regex "dest=(?P<dest_host>[^\s]+)" nodrop
| where !isEmpty(pkg_ref) OR !isEmpty(file_ext)
| where if(!isEmpty(dest_host), !(dest_host matches "*npmjs.org*" or dest_host matches "127.0.0.1" or dest_host matches "localhost"), true)
| eval severity = if(!isEmpty(file_ext) AND (file_ext = ".exe" OR file_ext = ".dll"), "critical", "high")
| fields _sourceHost, _sourceCategory, pkg_ref, file_ext, dest_host, severity, _messagetime
| sort by _messagetime desc

rule cve_2025_54313_eslint_config_prettier {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-54313 - Malicious code in eslint-config-prettier npm package"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54313"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and (
        $e.principal.process.command_line = /(?i)eslint-config-prettier/
        or $e.target.process.command_line = /(?i)eslint-config-prettier/
      )
    )
    or (
      $e.metadata.event_type = "FILE_CREATION"
      and $e.target.file.full_path = /(?i)eslint-config-prettier/
      and $e.target.file.full_path = /\.(?:exe|dll|sh|ps1|bat)$/
    )
    or (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      and $e.principal.process.file.full_path = /(?i)(node|npm)/
      and not $e.target.hostname = /(?i)(npmjs\.org|localhost)/
      and not $e.target.ip = "127.0.0.1"
    )

  condition:
    $e
}

#event_simpleName IN (ProcessRollup2, NetworkConnectIP4, FileOpenInfo)
| $event_simpleName = "ProcessRollup2"
  CommandLine = /(?i)eslint-config-prettier/
  OR ParentCommandLine = /(?i)eslint-config-prettier/
| union (
    #event_simpleName = "NetworkConnectIP4"
    ImageFileName = /(?i)(node|npm)/
    | LocalAddressIP4 != "127.0.0.1"
    | RemoteAddressIP4 != "104.16.0.0/12"
  )
| union (
    #event_simpleName = "FileOpenInfo"
    FilePath = /(?i)eslint-config-prettier/
    | FileName = /\.(?:exe|dll|sh|ps1|bat)$/i
  )
| select timestamp, ComputerName, UserName, CommandLine, ParentCommandLine, ImageFileName, RemoteAddressIP4, RemotePort, FilePath, FileName
| sort timestamp desc