CVE-2026-54051: network-ai npm Package OS Command Injection

let SuspiciousProcesses = dynamic(['cmd.exe', 'powershell.exe', 'sh', 'bash', 'dash', 'zsh', 'ksh']);
let CommandInjectionPatterns = dynamic([';', '&&', '||', '`', '$(',  '|', '>', '<', '%0a', '%0d']);
DeviceProcessEvents
| where TimeGenerated >= ago(24h)
| where InitiatingProcessFileName =~ 'node.exe' or InitiatingProcessCommandLine has 'network-ai'
| where FileName in~ (SuspiciousProcesses)
| where ProcessCommandLine has_any (CommandInjectionPatterns)
| project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| extend RiskScore = case(
    ProcessCommandLine has_any (dynamic(['wget', 'curl', 'nc', 'ncat', 'python', 'perl', 'ruby'])), 'Critical',
    ProcessCommandLine has_any (dynamic(['/etc/passwd', '/etc/shadow', 'whoami', 'id', 'net user'])), 'High',
    'Medium'
  )
| order by TimeGenerated desc

index=* sourcetype IN ("XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_audit", "osquery:results")
(ParentImage="*node.exe" OR ParentCommandLine="*network-ai*" OR cmdline="*network-ai*")
(
  (Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\sh", "*\\bash", "*\\dash"))
  OR
  (CommandLine IN ("*;*", "*&&*", "*||*", "*`*", "*$(*", "*%0a*", "*%0d*"))
)
| eval risk=case(
    match(CommandLine, "wget|curl|nc |ncat|python|perl|ruby"), "critical",
    match(CommandLine, "/etc/passwd|/etc/shadow|whoami|id |net user"), "high",
    true(), "medium"
  )
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(Image) as child_processes by host, user, ParentCommandLine, risk
| where count > 0
| sort - risk, - count

sequence by host.id with maxspan=30s
  [process where event.type == "start"
   and (process.parent.name in ("node", "node.exe") or process.parent.command_line like~ "*network-ai*")
   and process.name in ("sh", "bash", "dash", "zsh", "cmd.exe", "powershell.exe", "ksh")]
  [process where event.type == "start"
   and (process.command_line like~ "*whoami*" or process.command_line like~ "*id *" or
        process.command_line like~ "*/etc/passwd*" or process.command_line like~ "*net user*" or
        process.command_line like~ "*curl *" or process.command_line like~ "*wget *" or
        process.command_line like~ "*nc *" or process.command_line like~ "*python*")]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') as EventTime, sourceip, destinationip, username, "Process Name", "Command", "Parent Process Name", "Parent Command"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'SysMon')
AND ("Parent Process Name" ILIKE '%node%' OR "Parent Command" ILIKE '%network-ai%')
AND (
  "Process Name" ILIKE '%cmd.exe%' OR "Process Name" ILIKE '%powershell%'
  OR "Process Name" ILIKE '%/sh%' OR "Process Name" ILIKE '%/bash%'
  OR "Process Name" ILIKE '%/dash%'
)
AND (
  "Command" ILIKE '%whoami%' OR "Command" ILIKE '%/etc/passwd%'
  OR "Command" ILIKE '%curl %' OR "Command" ILIKE '%wget %'
  OR "Command" ILIKE '%nc %' OR "Command" ILIKE '%ncat%'
  OR "Command" ILIKE '%python%' OR "Command" ILIKE '%perl%'
)
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=*endpoint* OR _sourceCategory=*sysmon* OR _sourceCategory=*auditd*
| where (%"parent_process" matches /node(|\.exe)$/i or %"parent_commandline" matches /network-ai/i)
| where (%"process" matches /(cmd\.exe|powershell\.exe|\/sh|\/bash|\/dash|\/zsh)/i)
| where (%"commandline" matches /(whoami|id |net user|\/etc\/passwd|\/etc\/shadow|curl |wget |nc |ncat|python|perl|ruby)/i)
| count by _sourceHost, %"user", %"parent_commandline", %"commandline", %"process"
| sort by _count desc

rule cve_2026_54051_network_ai_cmd_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-54051 network-ai npm OS command injection exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "Execution, Privilege Escalation"
    mitre_attack_technique = "T1059, T1190"
    reference = "https://github.com/advisories/GHSA-qw6v-5fcf-5666"
    cve = "CVE-2026-54051"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.file.full_path = /node(|\.exe)$/i or
    $proc.principal.process.command_line = /network-ai/i
    $proc.target.process.file.full_path = /(cmd\.exe|powershell\.exe|\/sh|\/bash|\/dash|\/zsh|\/ksh)/i
    $proc.target.process.command_line = /(whoami|id |net user|\/etc\/passwd|curl |wget |nc |ncat|python|perl|ruby)/i

  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/node(\.exe)?$/i OR ParentCommandLine=/network-ai/i
| ImageFileName=/(cmd\.exe|powershell\.exe|\bsh\b|\bbash\b|\bdash\b|\bzsh\b|\bksh\b)/i
| CommandLine=/(whoami|\bid\b|net user|\/etc\/passwd|\/etc\/shadow|\bcurl\b|\bwget\b|\bnc\b|\bncat\b|\bpython\b|\bperl\b|\bruby\b)/i
| eval RiskLevel=if(match(CommandLine, /(curl|wget|nc|ncat|python|perl|ruby)/), "Critical", "High")
| stats count() as EventCount, values(CommandLine) as CommandLines, values(ImageFileName) as ChildProcesses by aid, UserName, ParentCommandLine, RiskLevel
| sort -RiskLevel, -EventCount