vm2 Sandbox Escape via Shared Buffer Pool Host-Memory Disclosure (CVE-2026-92947)

// Detect vulnerable vm2 package files and node processes loading vm2 (CVE-2026-92947)
let vulnCutoff = "3.11.7";
union isfuzzy=true
(
    DeviceFileEvents
    | where FolderPath has "node_modules" and FolderPath has_cs "vm2"
    | where FileName in~ ("package.json", "vm.js", "index.js")
    | project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, ActionType
),
(
    DeviceProcessEvents
    | where FileName in~ ("node", "node.exe")
    | where ProcessCommandLine has_cs "vm2" or ProcessCommandLine has "allocUnsafe" or ProcessCommandLine has "poolSize"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
)
| sort by Timestamp desc

index=* (sourcetype="linux:audit" OR sourcetype="WinEventLog:*" OR sourcetype="osquery:results")
 (path="*node_modules*vm2*" OR file_path="*node_modules*vm2*" OR process="*vm2*" OR CommandLine="*allocUnsafe*" OR CommandLine="*poolSize*")
| eval artifact=coalesce(path, file_path, process, CommandLine)
| stats count min(_time) as firstSeen max(_time) as lastSeen values(artifact) as artifacts by host, user
| convert ctime(firstSeen) ctime(lastSeen)
| sort - count

sequence by host.name with maxspan=10m
  [ process where process.name == "node" and
      (process.command_line : "*vm2*" or process.command_line : "*allocUnsafe*" or process.command_line : "*poolSize*") ]
  [ file where file.path : "*node_modules*vm2*" and file.name : ("package.json", "vm.js", "index.js") ]

SELECT QIDNAME(qid) AS event, sourceip, username, "Process Name" AS process, "Command Line" AS cmd, "Filename" AS filename, "File Path" AS filepath
FROM events
WHERE ("File Path" ILIKE '%node_modules%vm2%'
   OR "Command Line" ILIKE '%vm2%'
   OR "Command Line" ILIKE '%allocUnsafe%'
   OR "Command Line" ILIKE '%poolSize%')
ORDER BY starttime DESC LAST 7 DAYS

_sourceCategory=*/os/* OR _sourceCategory=*/endpoint/*
| where (%"path" matches "*node_modules*vm2*" or %"command_line" matches "*vm2*" or %"command_line" matches "*allocUnsafe*" or %"command_line" matches "*poolSize*")
| coalesce(%"path", %"command_line") as artifact
| count by host, user, artifact
| sort by _count desc

rule vm2_buffer_pool_escape_CVE_2026_92947 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects vulnerable vm2 package usage and Buffer-pool exploit indicators (CVE-2026-92947)"
    severity = "CRITICAL"
    cve = "CVE-2026-92947"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.command_line, `(?i)vm2`) or
      re.regex($e.target.process.command_line, `(?i)allocUnsafe`) or
      re.regex($e.target.process.command_line, `(?i)poolSize`) or
      re.regex($e.target.file.full_path, `node_modules.*vm2`)
    )
    $host = $e.principal.hostname
  match:
    $host over 10m
  condition:
    $e
}

#event_simpleName=/ProcessRollup2|PeFileWritten|NewExecutableWritten/
| ImageFileName=/node(\.exe)?$/i OR CommandLine=/vm2|allocUnsafe|poolSize/i OR TargetFileName=/node_modules.*vm2/i
| groupBy([ComputerName, UserName], function=collect([CommandLine, TargetFileName, ImageFileName]))
| sort(field=_count, order=desc)