Remotion RCE via Code Injection (CVE-2026-30120)

let RemotionRCEIndicators = dynamic(['remotion', '@remotion/', 'remotion-dev']);
let SuspiciousNodePatterns = dynamic(['child_process', 'eval(', 'Function(', 'execSync', 'spawnSync', 'exec(']);
union DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (ProcessCommandLine has_any (RemotionRCEIndicators) or InitiatingProcessCommandLine has_any (RemotionRCEIndicators))
| where ProcessCommandLine has_any (SuspiciousNodePatterns) or FileName in~ ('node', 'npx') and ProcessCommandLine has_any (SuspiciousNodePatterns)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, FileName, FolderPath, RemoteIP, RemotePort
| order by Timestamp desc

index=* sourcetype IN ("node:process", "osquery:process", "sysmon", "linux:audit", "wineventlog")
| search (process_name="node" OR process_name="npx" OR command_line="*remotion*" OR command_line="*@remotion*")
| where match(command_line, "(child_process|eval\\(|execSync|spawnSync|Function\\(|exec\\()")
| eval risk_score=case(
    match(command_line, "execSync|spawnSync"), 90,
    match(command_line, "child_process"), 80,
    match(command_line, "eval\\(|Function\\("), 85,
    true(), 70
  )
| table _time, host, user, process_name, command_line, parent_process, dest_ip, dest_port, risk_score
| sort - risk_score

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and (process.name in ("node", "npx") or process.args : "*remotion*")
    and process.args : ("*child_process*", "*execSync*", "*spawnSync*", "*eval(*", "*Function(*")]
  [process where event.type == "start"
    and process.parent.name in ("node", "npx")
    and not process.name in ("node", "npx", "ffmpeg", "chrome", "chromium")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time, sourceip, destinationip, username, "Process Name", "Command", QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'SyslogNG')
AND ("Command" ILIKE '%remotion%' OR "Command" ILIKE '%@remotion%')
AND ("Command" ILIKE '%child_process%' OR "Command" ILIKE '%execSync%' OR "Command" ILIKE '%spawnSync%' OR "Command" ILIKE '%eval(%' OR "Command" ILIKE '%Function(%')
AND LOGSOURCENAME(logsourceid) NOT IN ('Known-safe-ci-server')
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=*process* OR _sourceCategory=*node* OR _sourceCategory=*audit*
| where (_raw matches /remotion/ or _raw matches /@remotion/)
| where (_raw matches /child_process/ or _raw matches /execSync/ or _raw matches /spawnSync/ or _raw matches /eval\(/ or _raw matches /Function\(/)
| parse regex field=_raw "(?P<process_name>\\w+)\\s+(?P<command_line>.+)" nodrop
| eval severity = if(command_line matches /execSync|spawnSync/, "critical", if(command_line matches /eval\(|Function\(/, "high", "medium"))
| count by _sourceHost, process_name, command_line, severity
| order by _count desc

rule cve_2026_30120_remotion_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-30120 Remotion RCE exploitation via code injection"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30120"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      $e.target.process.command_line = /remotion/ nocase or
      $e.target.process.command_line = /@remotion/ nocase
    )
    (
      $e.target.process.command_line = /child_process/ nocase or
      $e.target.process.command_line = /execSync/ nocase or
      $e.target.process.command_line = /spawnSync/ nocase or
      $e.target.process.command_line = /eval\(/ or
      $e.target.process.command_line = /Function\(/
    )

  condition:
    $e
}

DeviceProcessEvents
| filter (CommandLine contains "remotion" or CommandLine contains "@remotion")
| filter (
    CommandLine contains "child_process" or
    CommandLine contains "execSync" or
    CommandLine contains "spawnSync" or
    CommandLine contains "eval(" or
    CommandLine contains "Function("
  )
| filter FileName in ("node.exe", "node", "npx", "npx.cmd")
| select timestamp, DeviceName, UserName, FileName, CommandLine, ParentProcessName, ParentCommandLine
| sort timestamp desc