LMDeploy Pickle Deserialization RCE via zmq_rpc.call_and_response() (CVE-2025-59953)

let lmdeployParents = dynamic(["python","python3","lmdeploy","uvicorn","gunicorn"]);
let suspiciousChildren = dynamic(["sh","bash","dash","zsh","nc","ncat","netcat","curl","wget","powershell.exe","cmd.exe","whoami","id","perl","ruby"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any (lmdeployParents)
    and (InitiatingProcessCommandLine has_any ("lmdeploy","zmq_rpc","turbomind","pytorch_engine","api_server") )
| where FileName has_any (suspiciousChildren)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessId, ProcessId
| order by Timestamp desc

index=edr (process_name IN ("sh","bash","dash","zsh","nc","ncat","curl","wget","whoami","id","perl","ruby","powershell.exe","cmd.exe"))
| join type=inner parent_process_guid [ search index=edr (parent_process_name IN ("python","python3","lmdeploy","uvicorn","gunicorn")) (parent_process=*lmdeploy* OR parent_process=*zmq_rpc* OR parent_process=*api_server* OR parent_process=*turbomind*) | fields parent_process_guid ]
| table _time, host, parent_process_name, parent_process, process_name, process, user
| sort - _time

process where event.type == "start" and
  process.parent.name in ("python","python3","lmdeploy","uvicorn","gunicorn") and
  process.parent.command_line : ("*lmdeploy*","*zmq_rpc*","*api_server*","*turbomind*","*pytorch_engine*") and
  process.name in ("sh","bash","dash","zsh","nc","ncat","netcat","curl","wget","whoami","id","perl","ruby","cmd.exe","powershell.exe")

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Parent Process Name" AS parent, "Process CommandLine" AS cmd, sourceip, destinationip, username, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOGSOURCETYPENAME(devicetype) IMATCHES '.*(Sysmon|Endpoint|CrowdStrike).*' AND "Parent Process Name" IMATCHES '.*(python|python3|lmdeploy|uvicorn|gunicorn).*' AND "Parent Process CommandLine" IMATCHES '.*(lmdeploy|zmq_rpc|api_server|turbomind).*' AND "Process Name" IMATCHES '.*(sh|bash|dash|nc|ncat|curl|wget|whoami|id|perl|ruby|cmd\.exe|powershell\.exe).*' ORDER BY devicetime DESC LAST 24 HOURS

_sourceCategory=*endpoint* ("lmdeploy" OR "zmq_rpc" OR "api_server" OR "turbomind")
| where (parentProcessName matches /(python|python3|lmdeploy|uvicorn|gunicorn)/ )
| where (processName matches /(sh|bash|dash|zsh|nc|ncat|curl|wget|whoami|id|perl|ruby|cmd\.exe|powershell\.exe)/ )
| fields _messageTime, host, parentProcessName, parentCommandLine, processName, commandLine, user
| sort by _messageTime desc

rule lmdeploy_pickle_rce_cve_2025_59953 {
  meta:
    author = "argus"
    description = "LMDeploy pickle deserialization RCE child-process execution (CVE-2025-59953)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(python|python3|lmdeploy|uvicorn|gunicorn)`)
    re.regex($e.principal.process.parent_process.command_line, `(lmdeploy|zmq_rpc|api_server|turbomind)`)
    re.regex($e.target.process.file.full_path, `(sh|bash|dash|zsh|nc|ncat|curl|wget|whoami|id|perl|ruby|cmd\.exe|powershell\.exe)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^(python|python3|lmdeploy|uvicorn|gunicorn)$/i
| CommandLine=/lmdeploy|zmq_rpc|api_server|turbomind/i OR ParentCommandLine=/lmdeploy|zmq_rpc|api_server|turbomind/i
| FileName=/^(sh|bash|dash|zsh|nc|ncat|curl|wget|whoami|id|perl|ruby|cmd\.exe|powershell\.exe)$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, UserName])