EtherRAT Self-Propagating Worm and Next.js Exploit
This rule detects activities associated with the EtherRAT self-propagating worm, specifically its module for scanning and exploiting vulnerable Next.js applications. It looks for combinations of mass port scanning tools (nmap, masscan, zmap, nc) targeting common web ports, logging of Next.js scan activities, `curl` commands with specific `Next-Action` headers indicative of Next.js exploitation, `node` or `nodejs` processes performing network connections to private IP ranges, and command lines containing patterns related to prototype pollution exploitation (e.g., `__proto__`, `constructor.prototype`). The rule correlates these activities to identify potential exploitation attempts against Next.js applications using the React2Shell vulnerability (CVE-2025-55182) and subsequent lateral movement or payload delivery.
Sigma
