CVE-2026-47208: vm2 Sandbox Breakout via Promise Species

let vm2SandboxEscape = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node", "node.exe")
| where ProcessCommandLine has_any ("vm2", "VM2")
| where ProcessCommandLine has_any ("Promise", "species", "Symbol.species", "__proto__", "constructor")
| project Timestamp, DeviceName, AccountName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
let suspiciousChildProcs = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node", "node.exe")
| where FileName in~ ("sh", "bash", "cmd.exe", "powershell.exe", "python", "python3", "perl", "ruby", "curl", "wget")
| project Timestamp, DeviceName, AccountName, ProcessId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId;
let npm2VulnPackage = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "package.json"
| where FolderPath has "vm2"
| project Timestamp, DeviceName, FolderPath, FileName;
vm2SandboxEscape
| union suspiciousChildProcs
| union npm2VulnPackage
| sort by Timestamp desc

index=* sourcetype IN ("WinEventLog:Security", "linux_secure", "auditd", "ProcessCreate", "sysmon")
| eval process_lower=lower(process)
| eval cmdline_lower=lower(cmdline)
| where (process_lower IN ("node", "node.exe") AND (match(cmdline_lower, "vm2") OR match(cmdline_lower, "symbol\.species") OR match(cmdline_lower, "promise") OR match(cmdline_lower, "__proto__")))
OR (parent_process_lower IN ("node", "node.exe") AND process_lower IN ("sh", "bash", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget", "perl"))
| eval risk_score=case(
    match(cmdline_lower, "symbol\.species") AND match(cmdline_lower, "vm2"), 95,
    process_lower IN ("sh","bash","cmd.exe","powershell.exe") AND parent_process_lower IN ("node","node.exe"), 85,
    match(cmdline_lower, "vm2") AND match(cmdline_lower, "promise"), 70,
    true(), 50
)
| where risk_score >= 70
| table _time, host, user, process, cmdline, parent_process, parent_cmdline, risk_score
| sort -risk_score

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.name in ("node", "node.exe")
    and (
      process.command_line like~ "*vm2*"
      or process.command_line like~ "*Symbol.species*"
      or process.command_line like~ "*Promise*species*"
    )
  ] by process.pid
  [process where event.type == "start"
    and process.parent.name in ("node", "node.exe")
    and process.name in ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget", "nc", "ncat", "perl", "ruby")
  ] by process.parent.pid

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "Process Name",
  "Command",
  "Parent Process Name",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'Sysmon')
  AND (
    (
      LOWER("Process Name") LIKE '%node%'
      AND (
        LOWER("Command") LIKE '%vm2%'
        OR LOWER("Command") LIKE '%symbol.species%'
        OR LOWER("Command") LIKE '%__proto__%'
      )
    )
    OR (
      LOWER("Parent Process Name") LIKE '%node%'
      AND LOWER("Process Name") IN ('sh', 'bash', 'cmd.exe', 'powershell.exe', 'python', 'python3', 'wget', 'curl', 'perl')
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=*process* OR _sourceCategory=*endpoint* OR _sourceCategory=*sysmon*
| where _raw matches /node(|\.exe)/i
| parse regex field=_raw "(?<cmdline>(?:command|CommandLine|cmd)[=: \"']+[^\"'\n]+)" nodrop
| where cmdline matches /vm2/i or cmdline matches /Symbol\.species/i or cmdline matches /__proto__/i or cmdline matches /Promise.*species/i
| eval risk="vm2_suspicious_args"
| union
(
  _sourceCategory=*process* OR _sourceCategory=*endpoint*
  | where _raw matches /ParentImage.*node(|\.exe)/i
  | parse regex field=_raw "(?<child_proc>Image[=: \"']+[^\"'\n]+)" nodrop
  | where child_proc matches /(sh|bash|cmd\.exe|powershell\.exe|python|curl|wget|perl)/i
  | eval risk="suspicious_child_from_node"
)
| count by _sourceHost, risk, cmdline
| sort by _count desc

rule cve_2026_47208_vm2_sandbox_escape {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-47208 vm2 sandbox breakout via Promise species manipulation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-76w7-j9cq-rx2j"
    mitre_attack = "T1059.007, T1203, T1068"

  events:
    $node_proc.metadata.event_type = "PROCESS_LAUNCH"
    $node_proc.principal.process.file.full_path = /node(\.exe)?$/i
    (
      $node_proc.target.process.command_line = /vm2/i or
      $node_proc.target.process.command_line = /Symbol\.species/i or
      $node_proc.target.process.command_line = /__proto__/i
    )

    $child_proc.metadata.event_type = "PROCESS_LAUNCH"
    $child_proc.principal.process.file.full_path = /node(\.exe)?$/i
    $child_proc.target.process.file.full_path = /(sh|bash|dash|cmd\.exe|powershell\.exe|python[23]?|curl|wget|perl|ruby)$/i

    $node_proc.principal.hostname = $child_proc.principal.hostname

  match:
    $node_proc.principal.hostname over 5m

  outcome:
    $risk_score = max(95)
    $target_cmd = array_distinct($child_proc.target.process.command_line)

  condition:
    $node_proc and $child_proc
}

#event_simpleName=ProcessRollup2
| CommandLine = /vm2/i OR CommandLine = /Symbol\.species/i OR CommandLine = /__proto__/i
| ImageFileName = /node(\.exe)?$/i
| eval vm2_args_detected=1
| join type=inner (
    #event_simpleName=ProcessRollup2
    | ParentBaseFileName = /node(\.exe)?$/i
    | FileName IN ["sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "python", "python3", "curl", "wget", "nc", "ncat", "perl", "ruby"]
    | eval suspicious_child=1
  ) ON [aid, ParentProcessId=ProcessId]
| table _time, ComputerName, UserName, ImageFileName, CommandLine, FileName, ParentBaseFileName
| sort -_time