CVE-2026-92941: vm2 NodeVM Host TLS Trust Store Replacement

// CVE-2026-92941 — vm2 TLS trust store manipulation / sandbox escape indicators
let caTrustFiles = dynamic(["ca-certificates.crt","cacert.pem","ca-bundle.crt","NODE_EXTRA_CA_CERTS"]);
union isfuzzy=true
(
DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node","node.exe")
| where ActionType in ("FileCreated","FileModified")
| where FileName has_any (caTrustFiles) or FolderPath has_any ("/etc/ssl/certs","/usr/local/share/ca-certificates","ca-trust")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, InitiatingProcessAccountName
),
(
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node","node.exe")
| where ProcessCommandLine has_any ("NODE_EXTRA_CA_CERTS","tls.rootCertificates","setGlobalDispatcher","child_process","spawn")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
)
| order by Timestamp desc

index=* (sourcetype="linux_secure" OR sourcetype="Syslog" OR sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational")
(process_name=node OR process_name=node.exe OR Image="*node*")
(file_path="*/etc/ssl/certs*" OR file_path="*ca-certificates*" OR file_path="*cacert.pem*" OR CommandLine="*NODE_EXTRA_CA_CERTS*" OR CommandLine="*tls.rootCertificates*" OR CommandLine="*child_process*")
| stats count min(_time) as firstTime max(_time) as lastTime values(file_path) as files values(CommandLine) as cmds by host process_name user
| convert ctime(firstTime) ctime(lastTime)
| where count > 0
| sort - lastTime

sequence by host.id with maxspan=5m
  [ process where process.name == "node" and process.args : ("*child_process*", "*NODE_EXTRA_CA_CERTS*", "*tls.rootCertificates*") ]
  [ file where process.name == "node" and event.type in ("creation","change") and
      (file.path : "/etc/ssl/certs/*" or file.name : ("ca-certificates.crt","cacert.pem","ca-bundle.crt")) ]

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Filename" AS filename, "Command Line" AS cmdline, sourceip, username, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE ("Process Name" ILIKE '%node%') AND ("Filename" ILIKE '%ca-certificates%' OR "Filename" ILIKE '%cacert.pem%' OR "Command Line" ILIKE '%NODE_EXTRA_CA_CERTS%' OR "Command Line" ILIKE '%tls.rootCertificates%' OR "Command Line" ILIKE '%child_process%') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*os* (node OR node.exe) ("ca-certificates" OR "cacert.pem" OR "ca-bundle.crt" OR "NODE_EXTRA_CA_CERTS" OR "tls.rootCertificates" OR "child_process")
| parse regex "(?<process>node[^\"\s]*)" nodrop
| parse regex "(?<path>/etc/ssl/certs/[^\s\"]+)" nodrop
| count by _sourceHost, process, path
| sort by _count

rule vm2_cve_2026_92941_tls_trust_store {
  meta:
    author = "argus"
    cve = "CVE-2026-92941"
    severity = "CRITICAL"
  events:
    $e.principal.process.file.full_path = /node/ nocase
    (
      $e.target.file.full_path = /(ca-certificates\.crt|cacert\.pem|ca-bundle\.crt|\/etc\/ssl\/certs\/)/ nocase or
      $e.principal.process.command_line = /(NODE_EXTRA_CA_CERTS|tls\.rootCertificates|child_process)/ nocase
    )
  condition:
    $e
}

#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/ "node"
| ImageFileName=/node(\.exe)?$/i
| CommandLine=/(NODE_EXTRA_CA_CERTS|tls\.rootCertificates|child_process|ca-certificates|cacert\.pem)/i
| groupBy([ComputerName, UserName, ImageFileName], function=collect([CommandLine]))
| sort(order=desc)