vm2 3.11.6 Sandbox Escape to Host RCE via call/apply Indirection (CVE-2026-92937)

// vm2 3.11.6 sandbox escape: Node.js process spawning unexpected child processes
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("node", "node.exe")
| where FileName in~ ("sh", "bash", "cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "whoami", "curl", "wget")
| extend ParentCmd = InitiatingProcessCommandLine
| where ParentCmd has_any ("vm2", "sandbox", "NodeVM", "VM") or FileName in~ ("whoami","curl","wget","sh","bash")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by Timestamp desc

index=os sourcetype="linux_secure" OR sourcetype="WinEventLog:Security" OR sourcetype="Sysmon:ProcessCreate"
| eval parent=lower(coalesce(ParentImage, parent_process)), child=lower(coalesce(Image, process))
| where like(parent, "%node%")
| where match(child, "(sh|bash|cmd\.exe|powershell|pwsh|whoami|curl|wget)$")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(child) as children values(CommandLine) as cmdlines by host, parent
| convert ctime(firstSeen) ctime(lastSeen)
| where count > 0

process where process.parent.name == "node" and process.name in ("sh", "bash", "dash", "cmd.exe", "powershell.exe", "pwsh.exe", "whoami", "curl", "wget") and not process.parent.args : ("*pm2*", "*forever*")

SELECT QIDNAME(qid) AS event, "Parent Process Name", "Process Name", "Command Line", sourceip, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOWER("Parent Process Name") LIKE '%node%' AND (LOWER("Process Name") LIKE '%sh' OR LOWER("Process Name") LIKE '%bash' OR LOWER("Process Name") LIKE '%cmd.exe' OR LOWER("Process Name") LIKE '%powershell%' OR LOWER("Process Name") LIKE '%whoami%' OR LOWER("Process Name") LIKE '%curl%' OR LOWER("Process Name") LIKE '%wget%') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*os* OR _sourceCategory=*sysmon*
| json auto nodrop
| where tolowercase(parentProcessName) matches "*node*"
| where tolowercase(processName) matches /(sh|bash|cmd\.exe|powershell|pwsh|whoami|curl|wget)$/
| count by host, parentProcessName, processName, commandLine
| sort by _count desc

rule vm2_sandbox_escape_cve_2026_92937 {
  meta:
    author = "Argus"
    description = "Node.js spawning shell/recon child process indicating vm2 3.11.6 host RCE"
    severity = "CRITICAL"
    cve = "CVE-2026-92937"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)node(\.exe)?$`)
    re.regex($e.target.process.file.full_path, `(?i)(sh|bash|cmd\.exe|powershell\.exe|pwsh|whoami|curl|wget)$`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2 event_platform IN (Lin, Win)
| ParentBaseFileName=/node(\.exe)?$/i
| FileName=/^(sh|bash|dash|cmd\.exe|powershell\.exe|pwsh|whoami|curl|wget)$/i
| groupBy([aid, ParentBaseFileName, FileName], function=([collect([CommandLine]), count(as=cnt)]))
| sort(cnt, order=desc)