CVE-2025-25249

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "node.exe" or FileName =~ "nodejs.exe"
| where ProcessCommandLine contains ".js" and ProcessCommandLine contains "http"
| where InitiatingProcessFileName =~ "sh" or InitiatingProcessFileName =~ "bash"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, RemoteIP, RemotePort, InitiatingProcessParentFileName, InitiatingProcessFileName

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 OR sourcetype=linux_audit EventCode=A_SYSCALL)
| where (CommandLine="*node.exe* .js *http*" OR CommandLine="*nodejs.exe* .js *http*") AND (ParentProcessName="sh" OR ParentProcessName="bash")
| table _time, host, CommandLine, ParentProcessName, ProcessName, DestIp, DestPort

Sigma

title: Fortinet FortiOS PivotC2 RAT Exploitation
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects exploitation of CVE-2025-25249 delivering PivotC2 RAT via Node.js and reverse shell.
author: SecBoard
date: 2026/09/10
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection:
    Image|endswith: 
      - '\node.exe'
      - '\nodejs.exe'
    CommandLine|contains: 
      - '.js'
      - 'http'
    ParentImage|endswith: 
      - '\sh.exe'
      - '\bash.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - cve.2025.25249
  - cisa_kev

Elastic ES|QL

from process where process.executable in ("node.exe", "nodejs.exe") and process.command_line : (".js", "http") and process.parent.executable in ("sh.exe", "bash.exe") | select @timestamp, host.name, process.parent.command_line, process.command_line, destination.ip, destination.port, process.parent.executable, process.executable