vm2 Sandbox Breakout via Dangerous Host Proto Mutators (CVE-2026-47698)

// Post-exploitation: Node.js process (vm2 host) spawning unexpected shells/command interpreters
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","bash","sh","/bin/sh","/bin/bash","whoami.exe","whoami","curl","wget","nc","ncat"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("node.exe","node")
| where FileName in~ (suspiciousChildren) or ProcessCommandLine has_any ("child_process","require('child_process')","process.mainModule","process.binding")
| where InitiatingProcessCommandLine has_any ("vm2","NodeVM","VM(","vm2/lib")
    or ProcessCommandLine has_any ("__proto__","constructor.constructor","process.mainModule.require")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessId
| order by Timestamp desc

index=* (sourcetype="linux:audit" OR sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval parent=lower(coalesce(parent_process_name, ParentImage, ppcomm))
| eval child=lower(coalesce(process_name, Image, comm))
| eval cmd=lower(coalesce(process, CommandLine, cmdline))
| where like(parent,"%node%")
| where (child IN ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","whoami","curl","wget","nc","ncat") OR like(cmd,"%child_process%") OR like(cmd,"%process.mainModule%") OR like(cmd,"%__proto__%") OR like(cmd,"%constructor.constructor%"))
| table _time, host, user, parent, child, cmd
| sort - _time

process where event.type == "start" and
  process.parent.name in ("node","node.exe") and
  (
    process.name in ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","whoami","whoami.exe","curl","wget","nc","ncat") or
    process.command_line : ("*child_process*","*process.mainModule*","*__proto__*","*constructor.constructor*")
  )

SELECT QIDNAME(qid) AS event, "Parent Process Name" AS parent, "Process Name" AS child, "Process CommandLine" AS cmd, sourceip, username, DATEFORMAT(devicetime,'YYYY-MM-dd HH:mm:ss') AS time
FROM events
WHERE LOWER("Parent Process Name") LIKE '%node%'
AND (
  LOWER("Process Name") IN ('cmd.exe','powershell.exe','pwsh.exe','bash','sh','whoami','curl','wget','nc','ncat')
  OR LOWER("Process CommandLine") LIKE '%child_process%'
  OR LOWER("Process CommandLine") LIKE '%process.mainmodule%'
  OR LOWER("Process CommandLine") LIKE '%__proto__%'
  OR LOWER("Process CommandLine") LIKE '%constructor.constructor%'
)
ORDER BY devicetime DESC LAST 7 DAYS

_sourceCategory=*sysmon* OR _sourceCategory=*auditd*
| json auto nodrop
| lower(coalesce(%"parentImage", %"ParentImage", %"ppcomm")) as parent
| lower(coalesce(%"image", %"Image", %"comm")) as child
| lower(coalesce(%"commandLine", %"CommandLine", %"cmdline")) as cmd
| where parent matches "*node*"
| where child in ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","whoami","curl","wget","nc","ncat") or cmd matches "*child_process*" or cmd matches "*process.mainmodule*" or cmd matches "*__proto__*" or cmd matches "*constructor.constructor*"
| fields _messageTime, host, parent, child, cmd

rule vm2_sandbox_breakout_cve_2026_47698 {
  meta:
    author = "Argus"
    description = "Node.js vm2 host spawning shell or referencing prototype-mutator escape primitives (CVE-2026-47698)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)node(\.exe)?$`)
    (
      $e.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|\/bash|\/sh|whoami|curl|wget|nc|ncat)/ or
      re.regex($e.target.process.command_line, `(?i)(child_process|process\.mainModule|__proto__|constructor\.constructor)`)
    )
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/node(\.exe)?/i
| ImageFileName=/(cmd\.exe|powershell\.exe|pwsh\.exe|bash|\/sh|whoami|curl|wget|nc|ncat)/i OR CommandLine=/(child_process|process\.mainModule|__proto__|constructor\.constructor)/i
| table([_time, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine])