MongoDB Lua/JS eval() sandbox-escape probing via constructor chain

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•5

Detects suspicious command line activity or network interactions targeting MongoDB, characterized by the use of 'eval' combined with specific function calls (such as 'process', 'load', 'require', or constructor-chaining) indicative of attempts to escape the MongoDB JavaScript sandbox.