A Node command probe searches for a writable staging directory

The week's finding

From 2026-09-09 through 2026-09-13 UTC, BlackDome retained 13 matching Node command-probe records across 6 sensors. These captured HTTP/HTTPS request-body instructions split into 11 downloader-staging records and 2 arithmetic-output records.

Follow the requested operation

The staging request is more specific than a generic downloader. Its request body combines __proto__:then and constructor:constructor references with child_process execSync. The requested command loop reads process working-directory links under /proc, then checks whether each directory exists and permits writing and search. It requests wget retrieval to botless, permission adjustment and invocation of the downloaded file.

For investigation, use the process-directory search as the triage pivot. Prioritize the route and object-reference path that admitted the input, then inspect the service's child-process activity and writes in process-associated directories where host telemetry is available.

MITRE ATT&CK describes Exploit Public-Facing Application as attempts to exploit a weakness in an Internet-facing host or system to initially access a network. Use that framing to organize this investigation around the receiving route, request-body handling and any child-process activity. Primary-source document

Counts and variations

For the reporting week starting 2026-09-07, the retained HTTP/HTTPS keyword-selected review cohort contains 754 event records in 222 daily source/input groups. The Node case contains 13 matching records across 6 sensors, 8 daily source/input groups and 3 distinct body texts.

The arithmetic-output records retain the object-reference structure but request an arithmetic echo and base64 output. Separate those 2 records from the 11 staging instructions in triage: they call for different follow-up. Group by normalized requested operation as well as whole-body content so an arithmetic-output probe and a delivery request do not collapse into one label.

The review cohort for the previous week, starting 2026-08-31, contained 374 retained records and 0 prototype-chain Node command-probe records. The week starting 2026-09-07 contained 754 retained review-cohort records and 13 prototype-chain Node command-probe records.

A practical local hunt

Apply this narrow text filter to retained request bodies to find the writable-directory staging variant. It requires the object-reference markers, command helper, process-directory vocabulary and downloader reference together. The staging filter selects the 11 staging records, not the arithmetic-only inputs.

def matches_node_staging(body):
    if not isinstance(body, str) or len(body.encode("utf-8")) > 65536:
        return False
    markers = ("__proto__:then", "constructor:constructor", "child_process",
               "execSync", "/proc/", "/cwd", "wget")
    return all(marker in body for marker in markers)

For a hit, identify the caller, exposed route and workload owner. Ask whether the requested operation matches an approved security test or approved change. Where host telemetry is available, correlate the request time with child-process activity, process working-directory link inspection, writes to process-associated directories, permission changes and attempted invocation of a newly written file.