CVE-2026-47137 — vm2 Sandbox Escape via nesting:true Bypass (RCE)

union DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("node", "node.exe", "nodejs")
| where (
    (ProcessCommandLine has "vm2" and ProcessCommandLine has_any ("nesting", "sandbox", "VM", "require"))
    or (InitiatingProcessCommandLine has "vm2" and InitiatingProcessCommandLine has_any ("nesting:true", "sandbox escape"))
    or (FileName has_any ("vm2") and ActionType == "FileCreated" and FolderPath has "node_modules")
  )
| extend SuspiciousChildProcess = iff(
    ProcessCommandLine has_any ("child_process", "exec", "spawn", "execSync", "spawnSync", "execFileSync"),
    true, false
  )
| extend NetworkEgress = iff(
    RemoteIPType == "Public" and ActionType == "NetworkConnectionSuccess",
    true, false
  )
| where SuspiciousChildProcess == true or NetworkEgress == true
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, ProcessCommandLine, RemoteIP, RemotePort,
    FileName, FolderPath, ActionType, SuspiciousChildProcess, NetworkEgress
| sort by TimeGenerated desc

index=* sourcetype IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_secure", "osquery:results", "auditd", "node_app_logs")
| eval is_node_parent = if(match(parent_process, "(?i)node(\.exe)?$") OR match(process_name, "(?i)node(\.exe)?$"), 1, 0)
| eval has_vm2_ref = if(match(cmdline, "(?i)vm2") OR match(cmdline, "nesting\s*[:=]\s*true"), 1, 0)
| eval spawns_shell = if(match(cmdline, "(?i)(child_process|exec|spawn|execSync|spawnSync|sh\s+-c|cmd\.exe|/bin/sh|bash\s+-c)"), 1, 0)
| eval outbound_conn = if(sourcetype="stream:tcp" AND direction="outbound" AND dest_ip!="127.0.0.1" AND NOT cidrmatch("10.0.0.0/8", dest_ip) AND NOT cidrmatch("192.168.0.0/16", dest_ip), 1, 0)
| where is_node_parent=1 AND has_vm2_ref=1 AND (spawns_shell=1 OR outbound_conn=1)
| stats count AS event_count, earliest(_time) AS first_seen, latest(_time) AS last_seen,
    values(cmdline) AS commands, values(dest_ip) AS remote_ips, values(user) AS users
    BY host, process_name, parent_process
| where event_count >= 1
| eval severity="CRITICAL", cve="CVE-2026-47137"
| sort - last_seen

sequence by host.name, process.parent.entity_id with maxspan=2m
  [process where event.type == "start"
   and process.name : ("node", "node.exe", "nodejs")
   and (process.args : "*vm2*" or process.command_line : "*nesting*true*" or process.command_line : "*sandbox*")
  ]
  [process where event.type == "start"
   and (
     process.name : ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh.exe", "python*", "perl*", "ruby*")
     or process.command_line : ("*child_process*", "*execSync*", "*spawnSync*", "*execFileSync*")
   )
  ]
| head 500

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  "process" AS process_name,
  "parentprocess" AS parent_process,
  "commandline" AS command_line,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'Sysmon')
  AND (
    ("parentprocess" ILIKE '%node%' OR "process" ILIKE '%node%')
    AND (
      "commandline" ILIKE '%vm2%'
      OR "commandline" ILIKE '%nesting%true%'
    )
    AND (
      "commandline" ILIKE '%child\_process%'
      OR "commandline" ILIKE '%execSync%'
      OR "commandline" ILIKE '%spawnSync%'
      OR "process" ILIKE '%sh%'
      OR "process" ILIKE '%bash%'
      OR "process" ILIKE '%cmd.exe%'
      OR "process" ILIKE '%powershell%'
    )
  )
  AND LOGSOURCETIME(starttime) > NOW() - 7 DAYS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=*linux* OR _sourceCategory=*windows* OR _sourceCategory=*node* OR _sourceCategory=*sysmon*
| parse regex "(?i)(?P<process_name>node(?:\.exe)?)" nodrop
| parse regex "(?i)(?P<vm2_ref>vm2|nesting[\s:=]+true|sandbox)" nodrop
| parse regex "(?i)(?P<shell_spawn>child_process|execSync|spawnSync|execFileSync|/bin/sh|bash -c|cmd\.exe|powershell)" nodrop
| where !isNull(process_name) AND !isNull(vm2_ref) AND !isNull(shell_spawn)
| timeslice 5m
| stats count AS event_count, last(_raw) AS sample_log, values(_sourceHost) AS hosts
    BY _timeslice, process_name, vm2_ref, shell_spawn
| where event_count >= 1
| sort by _timeslice desc
| fields _timeslice, hosts, process_name, vm2_ref, shell_spawn, event_count, sample_log

rule cve_2026_47137_vm2_sandbox_escape {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-47137 vm2 nesting:true sandbox escape leading to RCE"
    severity = "CRITICAL"
    confidence = "HIGH"
    mitre_attack = "T1059, T1055, T1068"
    cve = "CVE-2026-47137"

  events:
    $e1.metadata.event_type = "PROCESS_LAUNCH"
    $e1.target.process.file.full_path = /(?i)node(\.exe)?$/
    (
      $e1.target.process.command_line = /(?i)vm2/
      or $e1.target.process.command_line = /(?i)nesting[\s:=]+true/
    )
    $e1.principal.hostname = $host

    $e2.metadata.event_type = "PROCESS_LAUNCH"
    $e2.principal.hostname = $host
    $e2.principal.process.file.full_path = /(?i)node(\.exe)?$/
    (
      $e2.target.process.file.full_path = /(?i)(sh|bash|dash|zsh|cmd\.exe|powershell(\.exe)?)$/
      or $e2.target.process.command_line = /(?i)(child_process|execSync|spawnSync|execFileSync)/
    )

  match:
    $host over 2m

  condition:
    $e1 and $e2
}

event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4)
| filter ParentBaseFileName IN ("node", "node.exe", "nodejs")
  AND (
    CommandLine LIKE "%vm2%"
    OR CommandLine LIKE "%nesting%true%"
    OR CommandLine LIKE "%nesting:true%"
  )
| filter
  (
    FileName IN ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "pwsh.exe")
    OR CommandLine LIKE "%child_process%"
    OR CommandLine LIKE "%execSync%"
    OR CommandLine LIKE "%spawnSync%"
    OR CommandLine LIKE "%execFileSync%"
    OR (event_simpleName = "NetworkConnectIP4" AND NOT RemoteAddressIP4 IN ("127.0.0.1", "::1"))
  )
| groupby([ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4, RemotePort])
| stats count() AS event_count BY ComputerName, UserName, FileName, CommandLine
| sort event_count desc