Detect CVE-2026-47429: Vitest UI Server Arbitrary File Read and Execution in Google Chronicle

rule cve_2026_47429_vitest_ui_arbitrary_file_read {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-47429 Vitest UI server arbitrary file read and execution"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.principal.process.file.full_path = /node(|\.exe)$/
    (
      $process.target.process.command_line = /vitest/ and
      $process.target.process.command_line = /--ui|ui/
    )
    $process.principal.hostname = $hostname

    $network.metadata.event_type = "NETWORK_CONNECTION"
    $network.target.port in (51204, 51205, 5173, 5174, 4173)
    not $network.principal.ip in ("127.0.0.1", "::1")
    $network.principal.hostname = $hostname

    $file.metadata.event_type = "FILE_OPEN"
    $file.target.file.full_path = /(\.env$|id_rsa$|id_ed25519$|\.pem$|shadow$|passwd$|credentials|secrets|\.aws)/
    $file.principal.hostname = $hostname

  condition:
    $process and $network and $file
}