title: Shellshock Expression
description: Detects shellshock expressions in log files
references:
    - http://rubular.com/r/zxBfjWfFYs
logsource:
    product: linux
detection:
    expression:
        - /\(\)\s*\t*\{.*;\s*\}\s*;/
    condition: expression
falsepositives:
    - Unknown
level: high