SigmaHQ/rules/linux/lnx_shellshock.yml

title: Shellshock Expression
id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e
status: experimental
description: Detects shellshock expressions in log files
author: Florian Roth
date: 2017/03/14
modified: 2021/04/28
references:
    - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
logsource:
    product: linux
detection:
    keyword: 
        - '(){:;};'
        - '() {:;};'
        - '() { :;};'
        - '() { :; };'
    condition: keyword
falsepositives:
    - Unknown
level: high