Detects in-memory webshell indicators related to the proof-of-concept code for the React Server Remote Code Execution Vu

Hunt Hypothesis

This hunt hypothesis targets adversaries exploiting the React Server Remote Code Execution vulnerability (CVE-2025-55182) to deploy in-memory webshells that evade traditional file-based detection mechanisms. Proactively hunting for these indicators within Azure Sentinel is critical because such webshells often serve as a stealthy foothold for lateral movement and persistent command execution without leaving artifacts on the disk.

YARA Rule

rule EXPL_React_Server_CVE_2025_55182_POC_Dec25 {
   meta:
      description = "Detects in-memory webshell indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)"
      author = "Florian Roth"
      reference = "https://x.com/pyn3rd/status/1996840827897954542/photo/1"
      date = "2025-12-05"
      score = 70
      id = "1ad38541-1477-5c07-9975-318357bcb9b8"
   strings:
      $xs1 = "{const cmd=p.query.cmd;if(!cmd)(s.writeHead(400);"

      $s1 = ";if(p.pathname=="
      $s2 = ".writeHead(400);"
      $s3 = ".writeHead(200,{'Content-Type':"
      $s4 = ".execSync("
      $s5 = ",stdio:'pipe'})"
   condition:
      1 of ($x*)
      or all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding exclusion strategies for the Detects in-memory webshell indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182) rule:

Scenario: Scheduled Health Check Scripts
- Context: Enterprise monitoring tools like SolarWinds NPM or Datadog Agent often run scheduled PowerShell scripts on React-based application servers to verify service health. These scripts frequently load the System.Web assembly and instantiate temporary in-memory objects that mimic the signature of a webshell, specifically when they query the React server’s internal state via HTTP endpoints.
- Filter/Exclusion: Create an exclusion rule based on the Process Name (SolarWinds.Agent.exe, dd-agent.exe) and the Parent Process (e.g., svchost.exe or Task Scheduler). Additionally, filter out events where the command line contains specific keywords like /health-check or -scheduled.
Scenario: Automated CI/CD Deployment Pipelines
- Context: During deployment windows, tools such as Jenkins, GitLab Runners, or Azure DevOps Agents execute build and release pipelines. When deploying the React Server application, these agents often inject proof-of-concept code into memory to validate configuration before full rollout. This injection triggers the “in-memory webshell” signature as the agent dynamically compiles and loads the new React components.
- Filter/Exclusion: Exclude alerts originating from known CI/CD service accounts (e.g., svc-jenkins, azure-devops-agent) during defined maintenance windows. Implement a logic check that suppresses alerts if the process path resides within standard deployment directories like C:\Program Files\Jenkins or /var/lib/gitlab-runner.