Detect CVE-2026-47429: Vitest UI Server Arbitrary File Read and Execution in Microsoft Sentinel

let VitestPorts = dynamic([51204, 51205, 5173, 5174, 4173]);
union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where (
    (ActionType == "InboundConnectionAccepted" and LocalPort in (VitestPorts))
    or
    (FileName in~ ("node", "node.exe") and ProcessCommandLine has_any ("vitest", "--ui", "vitest/ui"))
  )
| extend IsVitestUI = ProcessCommandLine has "--ui" or ProcessCommandLine has "vitest ui"
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ ("node", "node.exe")
    | where FolderPath !startswith "C:\\Users" or FolderPath has_any (".env", "id_rsa", "passwd", "shadow", "/etc/")
    | project FileAccessTime=TimeGenerated, DeviceId, AccessedPath=FolderPath, InitiatingProcessCommandLine
) on DeviceId
| where isnotempty(AccessedPath)
| project TimeGenerated, DeviceName, ProcessCommandLine, AccessedPath, InitiatingProcessCommandLine, LocalPort
| extend RiskScore = case(
    AccessedPath has_any (".env", "id_rsa", "id_ed25519", ".pem", "shadow", "passwd", "credentials", "secrets"), 100,
    AccessedPath has_any ("/etc/", "C:\\Windows\\System32"), 80,
    50
  )
| where RiskScore >= 50
| order by RiskScore desc