Egress Network Connection from Node.js Descendant
Description
This rule detects when a network connection is established via a descendant of a Node.js process. Attackers may use Node.js to run scripts that create network connections for various malicious purposes, such as downloading and executing payloads, establishing persistence, or exfiltrating data.
Query · eql
sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and event.action == "exec" and not process.name == "node" and
(
descendant of [process where event.type == "start" and event.action == "exec" and process.name == "node" and
(
process.command_line : ("*post-install*", "*preinstall*") or
(process.args like "*/npm" and process.args in ("install", "update"))
)] or
(process.parent.name == "node" and process.parent.command_line like ("*post-install*", "*preinstall*")) or
(process.parent.name == "node" and process.parent.args like "*/npm" and process.parent.args in ("install", "update"))
) and not (
(process.name == "sh" and process.args == "-c" and process.args == "node") or
process.args like ("rebuild", "build", "compile", "copyfiles*") or
process.command_line in (
"sh -c :; (node ./preinstall.js > /dev/null 2>&1 || true)",
"""sh -c node -e "try{require('./_postinstall')}catch(e){}" || exit 0"""
)
) and (
process.name like (
"nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
"nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm"
) or
process.executable like (
"/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
"/proc/*", "/var/mail/*", "/var/www/*"
) or
(
process.name == "curl" and process.args like "*http*" and process.args in ("-o", "--output") and
process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
) or
(
process.name == "wget" and process.args like "*http*" and process.args in ("-O", "--output-document") and
process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/private/tmp/*")
) or
(process.name : "python*" and process.args : "-c" and process.args : (
"*import*pty*spawn*", "*import*subprocess*call*"
)) or
(process.name : "perl*" and process.args : "-e" and process.args : "*socket*" and process.args : (
"*exec*", "*system*"
)) or
(process.name : "ruby*" and process.args : ("-e", "-rsocket") and process.args : (
"*TCPSocket.new*", "*TCPSocket.open*"
)) or
(process.name : "lua*" and process.args : "-e" and process.args : "*socket.tcp*" and process.args : (
"*io.popen*", "*os.execute*"
)) or
(process.name : "php*" and process.args : "-r" and process.args : "*fsockopen*" and process.args : "*/bin/*sh*") or
(process.name : ("awk", "gawk", "mawk", "nawk") and process.args : "*/inet/tcp/*") or
(process.name in ("rvim", "vim", "vimdiff", "rview", "view") and process.args == "-c" and process.args : "*socket*")
) and not (
process.executable like (
"/usr/bin/terraform", "/opt/homebrew/Cellar/git/*/libexec/git-core/git-remote-http", "/usr/local/aws-cli/aws", "/usr/bin/env",
"/Applications/Xcode.app/Contents/Developer/usr/libexec/git-core/git-remote-http", "/usr/lib/git-core/git-remote-https", "/usr/bin/ssh",
"/home/linuxbrew/.linuxbrew/opt/git/libexec/git-core/git-remote-https", "/usr/lib/git-core/git-remote-https", "/usr/bin/git-remote-https",
"/usr/bin/ssh", "/var/lib/docker/*/git-remote-https", "/usr/libexec/git-core/git", "/home/linuxbrew/.linuxbrew/*", "/usr/lib/git-core/git"
) or
process.parent.executable like (
"/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby", "/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby",
"/usr/bin/git"
)
)
]
[network where event.type == "start" and event.action == "connection_attempted" and (
process.name like (
"nohup", "setsid", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
"nc.traditional", "socat", "telnet", "busybox", "mkfifo", "xterm",
"curl", "wget", "python*", "perl*", "ruby*", "lua*", "php*", "awk", "gawk", "mawk", "nawk", "rvim", "vim", "vimdiff", "rview",
"view"
) or
process.executable like (
"/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
"/proc/*", "/var/mail/*", "/var/www/*"
)
) and not (
destination.ip == null or destination.ip == "0.0.0.0" or
cidrmatch(
destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29",
"192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
"192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10",
"192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
"FF00::/8"
)
)
]