Ruby Rails Worker Spawns Suspicious Child Process After Active Storage Representation Request - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects a shell or discovery process spawned by a Ruby/Puma/Passenger Rails worker, consistent with the CVE-2026-66066 KindaRails2Shell RCE stage where a forged Active Storage variation dispatches Kernel#spawn. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte un processus shell ou de reconnaissance lance par un worker Ruby/Puma/Passenger, coherent avec le stade RCE de CVE-2026-66066 (KindaRails2Shell). Une fois secret_key_base recupere par lecture de fichier arbitraire, l'attaquant forge une variation Active Storage JSON signee de la forme {"send":["spawn","/bin/sh","-c","id"]}. Cette variation atteint Chainable#apply qui invoque builder.public_send(name, *argument) : le nom de methode "send" declenche Kernel#spawn, qui cree un veritable processus enfant au niveau du systeme d'exploitation. Ce stade RCE ne fonctionne que si l'application est configuree avec config.active_support.message_serializer = :json ; voir README_ANGLES_MORTS.md pour les limites de cette couverture. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: Ruby Rails Worker Spawns Suspicious Child Process After Active Storage Representation Request - STRICT
id: 6fb4dfe1-5b20-4556-9c5e-2a6d157c8959
status: experimental
description: |
Detects a shell or discovery process spawned by a Ruby/Puma/Passenger Rails worker, consistent with the CVE-2026-66066 KindaRails2Shell RCE stage where a forged Active Storage variation dispatches Kernel#spawn. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte un processus shell ou de reconnaissance lance par un worker Ruby/Puma/Passenger, coherent avec le stade RCE de CVE-2026-66066 (KindaRails2Shell). Une fois secret_key_base recupere par lecture de fichier arbitraire, l'attaquant forge une variation Active Storage JSON signee de la forme {"send":["spawn","/bin/sh","-c","id"]}. Cette variation atteint Chainable#apply qui invoque builder.public_send(name, *argument) : le nom de methode "send" declenche Kernel#spawn, qui cree un veritable processus enfant au niveau du systeme d'exploitation. Ce stade RCE ne fonctionne que si l'application est configuree avec config.active_support.message_serializer = :json ; voir README_ANGLES_MORTS.md pour les limites de cette couverture. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
- https://nvd.nist.gov/vuln/detail/CVE-2026-66066
- https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/
- https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails/
- https://gist.github.com/win3zz/ae02cb1c3be0b79f69b609f559e1f179
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-08-06
related:
- id: 6fd51abd-7d41-4115-b884-ca21205f3fa6
type: derived
logsource:
product: linux
category: process_creation
detection:
selection_parent_ruby_image:
ParentImage|endswith:
- '/ruby'
- '/puma'
- '/bundle'
selection_parent_rails_cmd:
ParentCommandLine|contains:
- 'puma'
- 'rails server'
- 'bin/rails'
- 'config.ru'
- 'passenger'
selection_parent_container_context:
ContainerName|contains: 'rails'
selection_parent_kubernetes_context:
KubernetesPodName|contains: 'rails'
selection_child_shell_or_tool:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/python'
- '/python3'
- '/perl'
- '/curl'
- '/wget'
- '/nc'
- '/ncat'
- '/socat'
- '/busybox'
- '/id'
- '/whoami'
- '/uname'
- '/env'
- '/printenv'
- '/cat'
selection_cli_discovery_or_network:
CommandLine|contains:
- ' id'
- 'id &&'
- ' id;'
- '/usr/bin/id'
- 'whoami'
- 'uname -a'
- 'printenv'
- ' env'
- '/proc/self/environ'
- 'curl http'
- 'curl -k'
- 'wget http'
- 'nc -e'
- 'ncat -e'
- 'socat '
- 'bash -i'
- '/dev/tcp/'
selection_child_suspicious_path:
Image|contains:
- '/tmp/'
- '/dev/shm/'
- '/var/tmp/'
filter_main_rails_asset_precompile:
CommandLine|contains:
- 'assets:precompile'
- 'bundle exec rake'
- 'bundle install'
filter_main_rails_healthcheck:
CommandLine|contains:
- 'rails runner'
- 'rails db:'
condition: >
(
selection_parent_ruby_image
and (selection_parent_rails_cmd or selection_parent_container_context or selection_parent_kubernetes_context)
)
and (
(selection_child_shell_or_tool and selection_cli_discovery_or_network)
or selection_child_suspicious_path
)
and not 1 of filter_main_*
fields:
- UtcTime
- Computer
- User
- Image
- CommandLine
- ParentImage
- ParentCommandLine
- CurrentDirectory
- ProcessId
- ParentProcessId
- ContainerId
- ContainerName
- KubernetesPodName
- KubernetesNamespace
falsepositives:
- Authorized administrator running troubleshooting commands under the same Rails service account
- Deployment or CI jobs that legitimately execute shell tools from the Rails worker during provisioning, already partly filtered
level: high
tags:
- attack.execution
- attack.discovery
- attack.t1059
- attack.t1059.004
- attack.t1082
- cve.2026-66066