rules/linux/lnx_shellshock.yml

title: Shellshock Expression
description: Detects shellshock expressions in log files
references:
    - http://rubular.com/r/zxBfjWfFYs
logsource:
    product: linux
detection:
    expression:
        - /\(\)\s*\t*\{.*;\s*\}\s*;/
    condition: expression
falsepositives:
    - Unknown
level: high
Rule: Shellshock Regex detection 2017-03-14 14:53:29 +01:00			`title: Shellshock Expression`
			`description: Detects shellshock expressions in log files`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
			`- http://rubular.com/r/zxBfjWfFYs`
Rule: Shellshock Regex detection 2017-03-14 14:53:29 +01:00			`logsource:`
			`product: linux`
			`detection:`
Fixed parse errors 2017-08-02 22:49:15 +02:00			`expression:`
			`- /\(\)\s\t\{.;\s\}\s*;/`
Rule: Shellshock Regex detection 2017-03-14 14:53:29 +01:00			`condition: expression`
			`falsepositives:`
			`- Unknown`
			`level: high`