Detect CVE-2026-47429: Vitest UI Server Arbitrary File Read and Execution in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "File Path" AS file_path,
  QIDNAME(qid) AS event_name
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'Sysmon')
  AND (
    (
      "Process Name" ILIKE '%node%'
      AND "Command" ILIKE '%vitest%'
      AND "Command" ILIKE '%ui%'
    )
    OR destinationport IN (51204, 51205, 5173, 5174, 4173)
  )
  AND (
    "File Path" ILIKE '%.env%'
    OR "File Path" ILIKE '%id_rsa%'
    OR "File Path" ILIKE '%id_ed25519%'
    OR "File Path" ILIKE '%shadow%'
    OR "File Path" ILIKE '%passwd%'
    OR "File Path" ILIKE '%credentials%'
    OR "File Path" ILIKE '%secrets%'
    OR "File Path" ILIKE '%aws/credentials%'
    OR (sourceip NOT IN ('127.0.0.1', '::1') AND destinationport IN (51204, 51205, 5173, 5174, 4173))
  )
LAST 24 HOURS
ORDER BY starttime DESC