Ray Dashboard Code Injection via CSRF (CVE-2025-62593)

let RayProcs = dynamic(["raylet","gcs_server","ray","python","default_worker.py"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("raylet", "gcs_server", "python", "python3") or InitiatingProcessCommandLine has_any ("ray::", "default_worker.py", "ray.job")
| where FileName in~ ("bash","sh","powershell.exe","pwsh","cmd.exe","curl","wget","nc","ncat","python","python3")
| where ProcessCommandLine has_any ("-c", "base64", "curl", "wget", "/dev/tcp/", "socket", "import os", "subprocess", "eval(", "exec(")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessRemoteSessionIP
| order by Timestamp desc

index=edr (process_name IN ("bash","sh","powershell.exe","pwsh","cmd.exe","curl","wget","nc","ncat","python","python3"))
| where (parent_process_name IN ("raylet","gcs_server","python","python3") OR match(parent_process, "ray::|default_worker\.py|ray\.job"))
| where match(process, "-c |base64|curl|wget|/dev/tcp/|import os|subprocess|eval\(|exec\(")
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as processes by host user parent_process_name
| convert ctime(firstTime) ctime(lastTime)
| sort - count

process where event.type == "start" and
  process.parent.name in ("raylet", "gcs_server", "python", "python3") and
  process.name in ("bash", "sh", "powershell.exe", "pwsh", "cmd.exe", "curl", "wget", "nc", "ncat", "python", "python3") and
  process.command_line : ("*-c *", "*base64*", "*curl*", "*wget*", "*/dev/tcp/*", "*subprocess*", "*import os*", "*eval(*", "*exec(*")

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Parent Process Name" AS parent, "Command Line" AS cmd, sourceip, username, DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS time FROM events WHERE "Parent Process Name" IN ('raylet','gcs_server','python','python3') AND "Process Name" IN ('bash','sh','powershell.exe','pwsh','cmd.exe','curl','wget','nc','ncat','python','python3') AND ("Command Line" ILIKE '%-c %' OR "Command Line" ILIKE '%base64%' OR "Command Line" ILIKE '%/dev/tcp/%' OR "Command Line" ILIKE '%subprocess%' OR "Command Line" ILIKE '%curl%' OR "Command Line" ILIKE '%wget%') LAST 24 HOURS

_sourceCategory=*endpoint* ("raylet" OR "gcs_server" OR "default_worker.py")
| where (parentProcessName in ("raylet","gcs_server","python","python3")) and (processName in ("bash","sh","powershell.exe","pwsh","cmd.exe","curl","wget","nc","ncat"))
| where commandLine matches /(-c |base64|curl|wget|\/dev\/tcp\/|subprocess|import os|eval\(|exec\()/
| count by host, user, parentProcessName, processName, commandLine
| sort by _count

rule ray_code_injection_cve_2025_62593 {
  meta:
    author = "Argus"
    description = "Ray daemon spawning shell/network tools via code injection (CVE-2025-62593)"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /raylet|gcs_server|default_worker\.py|python3?/ nocase
    $e.target.process.file.full_path = /bash|sh|powershell|pwsh|cmd\.exe|curl|wget|nc|ncat/ nocase
    $e.target.process.command_line = /-c |base64|curl|wget|\/dev\/tcp\/|subprocess|import os|eval\(|exec\(/ nocase
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| in(field="ParentBaseFileName", values=["raylet","gcs_server","python","python3"])
| in(field="FileName", values=["bash","sh","powershell.exe","pwsh","cmd.exe","curl","wget","nc","ncat"])
| CommandLine=/(-c |base64|curl|wget|\/dev\/tcp\/|subprocess|import os|eval\(|exec\()/i
| groupBy([aid, UserName, ParentBaseFileName, FileName, CommandLine])