Prototype Pollution in @deepstream/server (CVE-2026-49252)

union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where (ProcessCommandLine has "deepstream" or ProcessCommandLine has "@deepstream/server")
    or (InitiatingProcessCommandLine has "deepstream")
| extend SuspiciousPayload = iff(
    ProcessCommandLine has "__proto__" or ProcessCommandLine has "constructor" or ProcessCommandLine has "prototype",
    true, false
)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, RemoteIP, RemotePort, SuspiciousPayload
| order by TimeGenerated desc

index=* sourcetype IN ("node:app", "syslog", "auditd", "WinEventLog:Security")
| eval suspicious_proto = if(match(_raw, "(__proto__|\\[\"constructor\"\\]|Object\.prototype)"), 1, 0)
| eval deepstream_proc = if(match(process, "deepstream") OR match(command, "deepstream"), 1, 0)
| where deepstream_proc=1 OR (suspicious_proto=1 AND (match(source, "deepstream") OR match(_raw, "deepstream")))
| stats count by host, source, process, command, suspicious_proto, _time
| sort -_time
| table _time, host, source, process, command, suspicious_proto, count

sequence by host.name with maxspan=5m
  [process where event.action == "start"
    and (process.name == "node" or process.name == "node.js")
    and process.args : ("*deepstream*")]
  [network where event.action in ("connection_attempted", "connection_accepted")
    and destination.port in (6020, 6021, 6022)]
  [process where event.action == "start"
    and process.parent.name == "node"
    and (
      process.command_line : ("*__proto__*") or
      process.command_line : ("*constructor*") or
      process.env_vars : ("*prototype*")
    )]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip, destinationip, destinationport,
       "username", "processname", QIDNAME(qid) AS EventName,
       CATEGORYNAME(category) AS Category,
       UTF8(payload) AS RawPayload
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('LinuxSyslog', 'WindowsAuthServer', 'NodeJS')
  AND (
    UTF8(payload) ILIKE '%deepstream%'
    OR "processname" ILIKE '%deepstream%'
  )
  AND (
    UTF8(payload) ILIKE '%__proto__%'
    OR UTF8(payload) ILIKE '%constructor%'
    OR UTF8(payload) ILIKE '%prototype%'
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LAST 1000

_sourceCategory=*node* OR _sourceCategory=*deepstream* OR _sourceName=*deepstream*
| where _raw matches "*deepstream*" or _raw matches "*@deepstream/server*"
| parse regex field=_raw "(?<proto_keyword>__proto__|constructor|Object\.prototype)" nodrop
| if(isNull(proto_keyword), "clean", proto_keyword) as proto_keyword
| count by _sourceHost, _sourceName, proto_keyword, _messagetime
| where proto_keyword != "clean"
| order by _messagetime desc

rule cve_2026_49252_deepstream_prototype_pollution {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects prototype pollution exploitation attempts against @deepstream/server (CVE-2026-49252)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-9v98-6g37-x9g6"
  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      AND (
        $e.target.process.command_line = /deepstream/ nocase
        OR $e.principal.process.command_line = /deepstream/ nocase
      )
    ) OR (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      AND $e.target.port = 6020
    )
    AND (
      $e.target.process.command_line = /__proto__/ nocase
      OR $e.target.process.command_line = /constructor/ nocase
    )
  condition:
    $e
}

DeviceProcessEvents
| filter timestamp > now() - 24h
| filter (
    ImageFileName contains "node" or
    CommandLine contains "deepstream"
  )
| filter (
    CommandLine contains "__proto__" or
    CommandLine contains "constructor" or
    CommandLine contains "prototype"
  )
| select timestamp, DeviceName, UserName, ImageFileName, CommandLine, ParentImageFileName, ParentCommandLine, SHA256HashData
| sort timestamp desc
| limit 1000