{"id":"6eea1bf6-f8d2-488a-a742-e6ef6c1b67db","title":"OMIGOD SCX RunAsProvider ExecuteScript","description":"Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.\nScript being executed gets created as a temp file in /tmp folder with a scx* prefix.\nThen it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.\nThe file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\nMicrosoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\n","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"high","date":"2021-10-15","modified":"2022-10-05","tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.t1068","attack.t1190","attack.t1203"],"technique_ids":["T1068","T1190","T1203"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate use of SCX RunAsProvider ExecuteScript."],"references":["https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure","https://github.com/Azure/Azure-Sentinel/pull/3059"],"source_path":"rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml","source_sha256":"1a56119232c93847f321a4ba84449fd72ab43ed286e411500b56f419ae8badac","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: OMIGOD SCX RunAsProvider ExecuteScript\nid: 6eea1bf6-f8d2-488a-a742-e6ef6c1b67db\nstatus: test\ndescription: |\n    Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.\n    Script being executed gets created as a temp file in /tmp folder with a scx* prefix.\n    Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.\n    The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including\n    Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.\nreferences:\n    - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure\n    - https://github.com/Azure/Azure-Sentinel/pull/3059\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-10-05\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.execution\n    - attack.t1068\n    - attack.t1190\n    - attack.t1203\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        User: root\n        LogonId: 0\n        CurrentDirectory: '/var/opt/microsoft/scx/tmp'\n        CommandLine|contains: '/etc/opt/microsoft/scx/conf/tmpdir/scx'\n    condition: selection\nfalsepositives:\n    - Legitimate use of SCX RunAsProvider ExecuteScript.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"},{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/6eea1bf6-f8d2-488a-a742-e6ef6c1b67db.json","kind":"sigma"}