vm2 NodeVM Custom Resolver Path Boundary Bypass (CVE-2026-100721)

// Detect vulnerable vm2 package presence and anomalous Node.js child process / file resolution post-exploit
let vulnPkg = DeviceFileEvents
| where FileName =~ "package.json"
| where FolderPath has "vm2"
| where FolderPath matches regex @"node_modules[\\/]+vm2[\\/]+package\.json$";
let suspiciousChild = DeviceProcessEvents
| where InitiatingProcessFileName in~ ("node.exe","node")
| where FileName in~ ("cmd.exe","powershell.exe","bash","sh","/bin/sh","child_process")
    or ProcessCommandLine has_any ("require('child_process')","require(\"child_process\")","process.binding","constructor.constructor","mainModule.require")
| project Timestamp, DeviceId, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName;
union 
(vulnPkg | project Timestamp, DeviceId, DeviceName, Evidence=strcat("vulnerable vm2 package.json at ", FolderPath)),
(suspiciousChild | project Timestamp, DeviceId, DeviceName, Evidence=strcat("suspicious node child: ", FileName, " :: ", ProcessCommandLine))
| sort by Timestamp desc

(index=os sourcetype="linux_secure" OR sourcetype="WinEventLog:Security") 
| eval is_node=if(match(parent_process_name,"(?i)node(\.exe)?$"),1,0)
| search is_node=1 (process_name="cmd.exe" OR process_name="powershell.exe" OR process_name="sh" OR process_name="bash" OR process="*child_process*" OR process="*constructor.constructor*" OR process="*mainModule.require*")
| stats count min(_time) as firstTime max(_time) as lastTime values(process) as processes by host parent_process_name process_name user
| `ctime(firstTime)` | `ctime(lastTime)`
| sort - count

process where event.type == "start" and
  process.parent.name : ("node", "node.exe") and
  (
    process.name : ("sh", "bash", "cmd.exe", "powershell.exe", "/bin/sh") or
    process.command_line : ("*constructor.constructor*", "*mainModule.require*", "*require('child_process')*", "*process.binding*")
  )

SELECT QIDNAME(qid) AS event, sourceip, destinationip, "Process Name" AS process, "Parent Process Name" AS parent, "Command Line" AS cmd, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS when FROM events WHERE LOWER("Parent Process Name") LIKE '%node%' AND (LOWER("Process Name") IN ('sh','bash','cmd.exe','powershell.exe') OR "Command Line" ILIKE '%constructor.constructor%' OR "Command Line" ILIKE '%mainModule.require%' OR "Command Line" ILIKE '%child_process%') ORDER BY starttime DESC LAST 7 DAYS

_sourceCategory=*os* OR _sourceCategory=*endpoint*
| where (toLowerCase(parentProcessName) matches "*node*")
| where (toLowerCase(processName) in ("sh","bash","cmd.exe","powershell.exe") 
    or commandLine matches "*constructor.constructor*" 
    or commandLine matches "*mainModule.require*" 
    or commandLine matches "*child_process*")
| count by host, parentProcessName, processName, user, commandLine
| sort by _count

rule vm2_custom_resolver_bypass_cve_2026_100721 {
  meta:
    author = "argus"
    description = "Node.js child process spawn with vm2 sandbox-escape primitives (CVE-2026-100721)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)node(\.exe)?$`)
    (
      $e.target.process.file.full_path = /(?i)(sh|bash|cmd\.exe|powershell\.exe)$/ nocase or
      re.regex($e.target.process.command_line, `constructor\.constructor|mainModule\.require|child_process`)
    )
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/node(\.exe)?$/i
| (ImageFileName=/\\(cmd|powershell)\.exe$/i or ImageFileName=/\/(sh|bash)$/i or CommandLine=/constructor\.constructor|mainModule\.require|child_process/i)
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName, UserName], function=collect([CommandLine]))
| sort(field=_count, order=desc)