{"id":"21541900-27a9-4454-9c4c-3f0a4240344a","title":"OMIGOD SCX RunAsProvider ExecuteShellCommand","description":"Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.\nSCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\nMicrosoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\n","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"high","date":"2021-10-15","modified":"2022-10-05","tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.t1068","attack.t1190","attack.t1203"],"technique_ids":["T1068","T1190","T1203"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand."],"references":["https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure","https://github.com/Azure/Azure-Sentinel/pull/3059"],"source_path":"rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml","source_sha256":"140dab57f8b12608c9f554a4513677650b6d1fd326d582f6fedb1d0485cef91f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: OMIGOD SCX RunAsProvider ExecuteShellCommand\nid: 21541900-27a9-4454-9c4c-3f0a4240344a\nstatus: test\ndescription: |\n    Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.\n    SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\n    Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\nreferences:\n    - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure\n    - https://github.com/Azure/Azure-Sentinel/pull/3059\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-10-05\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.execution\n    - attack.t1068\n    - attack.t1190\n    - attack.t1203\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        User: root\n        LogonId: 0\n        CurrentDirectory: '/var/opt/microsoft/scx/tmp'\n        CommandLine|contains: '/bin/sh'\n    condition: selection\nfalsepositives:\n    - Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"},{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/21541900-27a9-4454-9c4c-3f0a4240344a.json","kind":"sigma"}