Shellshock Expression — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems). Source status: test; severity: high. Source dates: 2017-03-14 / 2022-10-09.

{
  "product": "linux"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: a8f9292981105bad5c92c36b36350d2d81d93ac33388368b0f05f2bb0ca0d58d

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Shellshock Expression
id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e
status: test
description: Detects shellshock expressions in log files
references:
    - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
author: Florian Roth (Nextron Systems)
date: 2017-03-14
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    product: linux
detection:
    keywords:
        - '(){:;};'
        - '() {:;};'
        - '() { :;};'
        - '() { :; };'
    condition: keywords
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf