vm2 Native Code Execution via crypto.setEngine Sandbox Escape (CVE-2026-92939)

// CVE-2026-92939 - vm2 crypto.setEngine native code execution
// Surface Node.js processes loading native engine modules or spawning children (escape payload)
let nodeProcs = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("node", "node.exe", "nodejs");
// Child process spawned by a node process == strong post-escape signal for a pure-JS workload
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("node", "node.exe", "nodejs")
| where FileName in~ ("sh", "bash", "cmd.exe", "powershell.exe", "pwsh", "gcc", "cc", "ld", "openssl", "whoami", "id", "curl", "wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| union (
    DeviceImageLoadEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName in~ ("node", "node.exe", "nodejs")
    | where FileName endswith ".so" or FileName endswith ".dll" or FileName endswith ".node"
    | where not(FolderPath has_any ("node_modules", "\\nodejs\\", "/usr/lib/node", "/usr/local/lib/node"))
    | project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath
)
| order by Timestamp desc

index=* (sourcetype="linux:audit" OR sourcetype="WinEventLog:Sysmon" OR sourcetype="sysmon")
| eval parent=lower(coalesce(ParentImage, parent_process_name, exe))
| eval child=lower(coalesce(Image, process_name, comm))
| where like(parent, "%node%")
| where match(child, "(sh|bash|dash|cmd\.exe|powershell\.exe|pwsh|openssl|gcc|cc|ld|whoami|id|curl|wget)$")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(child) as children values(CommandLine) as cmdlines by host, parent, user
| convert ctime(firstSeen) ctime(lastSeen)
| sort - count

sequence by host.id with maxspan=30s
  [ process where process.name == "node" ]
  [ any where (event.category == "process" and process.parent.name == "node" and process.name in ("sh", "bash", "openssl", "gcc", "cc", "ld", "whoami", "id", "curl", "wget")) or
              (event.category == "library" and process.name == "node" and (dll.path like "*.so" or dll.path like "*.node" or dll.path like "*.dll") and not dll.path like "*node_modules*") ]

SELECT QIDNAME(qid) AS event, "Parent Process Name" AS parent, "Process Name" AS child, "Command Line" AS cmd, sourceip, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE LOWER("Parent Process Name") LIKE '%node%' AND LOWER("Process Name") IMATCHES '.*(sh|bash|cmd\.exe|powershell\.exe|pwsh|openssl|gcc|cc|ld|whoami|id|curl|wget)$' AND starttime > NOW() - 7 DAYS ORDER BY starttime DESC

_sourceCategory=*os* (node) ("exec" OR "execve" OR "process")
| json auto nodrop
| lower(parent_process_name) as parent
| lower(process_name) as child
| where parent matches "*node*"
| where child matches /(sh|bash|cmd\.exe|powershell\.exe|pwsh|openssl|gcc|cc|ld|whoami|id|curl|wget)$/
| count by host, parent, child, user, command_line
| sort by _count

rule vm2_setengine_native_escape_cve_2026_92939 {
  meta:
    author = "Argus"
    description = "vm2 crypto.setEngine native code execution escape (CVE-2026-92939)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)node(\.exe)?$`)
    re.regex($e.target.process.file.full_path, `(?i)(sh|bash|cmd\.exe|powershell\.exe|pwsh|openssl|gcc|cc|ld|whoami|id|curl|wget)$`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/node(\.exe)?/i
| ImageFileName=/(\/|\\)(sh|bash|cmd\.exe|powershell\.exe|pwsh|openssl|gcc|cc|ld|whoami|id|curl|wget)$/i
| groupBy([aid, ComputerName, ParentBaseFileName, ImageFileName, CommandLine], function=count())
| sort(count, order=desc)