Detect CVE-2026-47208: vm2 Sandbox Breakout via Promise Species in Google Chronicle

rule cve_2026_47208_vm2_sandbox_escape {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-47208 vm2 sandbox breakout via Promise species manipulation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-76w7-j9cq-rx2j"
    mitre_attack = "T1059.007, T1203, T1068"

  events:
    $node_proc.metadata.event_type = "PROCESS_LAUNCH"
    $node_proc.principal.process.file.full_path = /node(\.exe)?$/i
    (
      $node_proc.target.process.command_line = /vm2/i or
      $node_proc.target.process.command_line = /Symbol\.species/i or
      $node_proc.target.process.command_line = /__proto__/i
    )

    $child_proc.metadata.event_type = "PROCESS_LAUNCH"
    $child_proc.principal.process.file.full_path = /node(\.exe)?$/i
    $child_proc.target.process.file.full_path = /(sh|bash|dash|cmd\.exe|powershell\.exe|python[23]?|curl|wget|perl|ruby)$/i

    $node_proc.principal.hostname = $child_proc.principal.hostname

  match:
    $node_proc.principal.hostname over 5m

  outcome:
    $risk_score = max(95)
    $target_cmd = array_distinct($child_proc.target.process.command_line)

  condition:
    $node_proc and $child_proc
}