Nx Console Embedded Malicious Code Execution (CVE-2026-48027)

let SuspectParents = dynamic(["code", "code-insiders", "code - insiders", "webstorm", "idea", "rider", "node"]);
let LateralBinaries = dynamic(["powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "python", "python3", "curl", "wget", "certutil", "mshta", "wscript", "cscript", "nc", "ncat", "socat"]);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("nx-console", "@nrwl/nx-console", "nxls", "nx-language-server")
   or (InitiatingProcessFileName has_any (SuspectParents) and FileName has_any (LateralBinaries))
| extend ExtensionHostSuspicion = iff(
    InitiatingProcessFileName has_any (SuspectParents) and FileName has_any (LateralBinaries), true, false)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, ExtensionHostSuspicion
| order by TimeGenerated desc

index=endpoint sourcetype IN ("xmlwineventlog", "crowdstrike:events:sensor", "carbon_black:edr") 
| eval parent_lower=lower(parent_process_name), proc_lower=lower(process_name), cmdline_lower=lower(process_cmdline)
| where (match(parent_lower, "(code|code-insiders|webstorm|idea|rider)") AND match(proc_lower, "(powershell|pwsh|cmd\.exe|bash|sh|python|curl|wget|certutil|mshta|wscript|cscript|nc|ncat|socat)"))
   OR match(cmdline_lower, "(nx-console|@nrwl\/nx-console|nxls|nx-language-server)")
| eval risk_score=case(
    match(proc_lower, "(powershell|pwsh|mshta|certutil)"), 90,
    match(proc_lower, "(curl|wget|nc|ncat|socat)"), 85,
    match(proc_lower, "(cmd\.exe|bash|sh)"), 60,
    true(), 40)
| table _time, host, user, parent_process_name, process_name, process_cmdline, risk_score
| sort - risk_score, _time

sequence by host.name, process.parent.entity_id with maxspan=30s
  [process where event.type == "start"
   and process.parent.name : ("code", "code-insiders", "webstorm", "idea64", "rider")
   and process.name : ("powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "python*", "curl", "wget", "certutil.exe", "mshta.exe", "wscript.exe", "cscript.exe", "nc", "ncat", "socat")]
  [any where event.category : ("network", "file")
   and (
     (event.category == "network" and network.direction : ("outbound", "egress") and not destination.ip : ("127.0.0.0/8", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"))
     or
     (event.category == "file" and file.path : ("/tmp/*", "C:\\Users\\*\\AppData\\Roaming\\*", "/var/tmp/*") and file.extension : ("sh", "ps1", "py", "exe", "elf"))
   )]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "Process Name" AS process_name,
  "Parent Process Name" AS parent_process,
  "Command" AS cmdline,
  logsourcename(logsourceid) AS log_source,
  magnitude
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'CrowdStrike Falcon', 'Carbon Black Response')
  AND (
    (LOWER("Parent Process Name") MATCHES '.*(code|code-insiders|webstorm|idea64|rider).*'
     AND LOWER("Process Name") MATCHES '.*(powershell|pwsh|cmd\.exe|bash|\/sh|python|curl|wget|certutil|mshta|wscript|cscript|ncat|socat).*')
    OR LOWER("Command") MATCHES '.*(nx-console|@nrwl/nx-console|nxls|nx-language-server).*'
  )
  AND INOFFENSE()
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=endpoint/process OR _sourceCategory=endpoint/windows
| where (toLowerCase(%"process.parent.name") matches /code|code-insiders|webstorm|idea64|rider/
         and toLowerCase(%"process.name") matches /powershell|pwsh|cmd\.exe|bash|\/sh$|python|curl|wget|certutil|mshta|wscript|cscript|ncat|socat/)
     or toLowerCase(%"process.cmdline") matches /nx-console|@nrwl\/nx-console|nxls|nx-language-server/
| eval risk = if(toLowerCase(%"process.name") matches /powershell|mshta|certutil/, "HIGH",
                if(toLowerCase(%"process.name") matches /curl|wget|ncat|socat/, "HIGH", "MEDIUM"))
| count by _sourceHost, %"user.name", %"process.parent.name", %"process.name", %"process.cmdline", risk
| order by risk, _count desc

rule nx_console_malicious_code_cve_2026_48027 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects embedded malicious code execution from Nx Console VS Code extension (CVE-2026-48027)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.parent_process.file.full_path = /(?i)(code|code-insiders|webstorm|idea64|rider)/
    $e.target.process.file.full_path = /(?i)(powershell|pwsh|cmd\.exe|\/bash|\/sh$|python3?|curl|wget|certutil|mshta|wscript|cscript|ncat|socat)/

  condition:
    $e
}

event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("code", "code-insiders", "webstorm64.exe", "idea64.exe", "rider64.exe", "node")
| FileName IN ("powershell.exe", "pwsh.exe", "cmd.exe", "bash", "sh", "python", "python3", "curl", "wget", "certutil.exe", "mshta.exe", "wscript.exe", "cscript.exe", "nc", "ncat", "socat")
  OR CommandLine = /(?i)(nx-console|@nrwl\/nx-console|nxls|nx-language-server)/
| eval RiskTier=case(
    FileName IN ("powershell.exe", "pwsh.exe", "mshta.exe", "certutil.exe"), "CRITICAL",
    FileName IN ("curl", "wget", "nc", "ncat", "socat"), "HIGH",
    true(), "MEDIUM")
| table _time, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine, RiskTier
| sort -RiskTier, -_time