Detects RCE indicators related to the exploitation attempts of the React Server Remote Code Execution Vulnerability (CVE

Hunt Hypothesis

This hunt hypothesis identifies adversary behavior exploiting the React Server Remote Code Execution vulnerability (CVE-2025-55182) to execute arbitrary code on web servers. Proactive hunting for these indicators in Azure Sentinel is critical because successful exploitation can lead to immediate system compromise, allowing attackers to establish persistence and pivot within the environment before standard alerts trigger.

YARA Rule

rule EXPL_SUSP_JS_Exploitation_Payloads_Dec25 {
   meta:
      description = "Detects RCE indicators related to the exploitation attempts of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) as observed in the wild"
      author = "Florian Roth"
      reference = "https://www.greynoise.io/blog/cve-2025-55182-react2shell-opportunistic-exploitation-in-the-wild-what-the-greynoise-observation-grid-is-seeing-so-far"
      date = "2025-12-06"
      score = 70
      id = "91220a9b-bb97-5fdf-b14d-fac36d6bed3a"
   strings:
      $a1 = "process.mainModule.require('child_process')"

      $x1 = ".execSync('powershell -enc SQBFAFgAIAA"

      $sa1 = ".execSync('powershell"
      $sa2 = ".execSync('curl "
      $sa3 = ".execSync('wget "

      $sb01 = " -e "
      $sb02 = " -ec "
      $sb03 = " -en "
      $sb04 = " -enc "
      $sb05 = " -enco "
      $sb06 = " -encodedcommand "
      $sb07 = " | bash"
      $sb08 = " | sh"
      $sb09 = "|bash"
      $sb10 = "|sh"

      $sc1 = ").DownloadString(" ascii wide base64
      $sc2 = "IEX (New-Object " ascii wide base64
   condition:
      $a1
      and (
         1 of ($x*)
         or (
            1 of ($sa*)
            and 1 of ($sb*)
         )
         or 1 of ($sc*)
      )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 17 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the React Server RCE Vulnerability (CVE-2025-55182) detection rule, including suggested filters and exclusions:

Automated CI/CD Pipeline Builds
- Scenario: During nightly build cycles, the internal Jenkins or GitLab Runner agents execute npm run build commands on React server artifacts. The build process often involves spawning temporary Node.js processes that parse complex JSON payloads containing dynamic template strings (e.g., ${process.env.VAR}), which mimics the string interpolation attack vector of CVE-2025-55182.
- Filter/Exclusion: Exclude alerts where the source process name is jenkins-agent.exe, gitlab-runner.exe, or node running under a specific service account (e.g., svc-build-pipeline) and the destination port is restricted to internal build network ranges (e.g., 10.20.x.x).
Scheduled Database Backup & Reporting Jobs
- Scenario: A scheduled SQL Server Agent job triggers a PowerShell script that invokes a React-based reporting dashboard to generate PDF summaries. The script passes large, unescaped XML/JSON payloads containing user-generated content into the React server’s rendering engine, triggering RCE indicators due to the heavy parsing of nested objects.
- Filter/Exclusion: Create an exclusion rule for alerts occurring between 02:00 and 04:00 UTC on weekdays where the initiating process is sqlagent.exe or a specific scheduled task name (e.g., \Microsoft\ReportingServices\DailyReportGen) and the user context is DOMAIN\svc-reporting.
Third-Party Content Management System (CMS) Synchronization
- Scenario: An enterprise CMS (such as Sitecore or Adobe Experience Manager) running