rules/linux/lnx_shellshock.yml

title: Shellshock Expression
id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e
status: experimental
description: Detects shellshock expressions in log files
author: Florian Roth
date: 2017/03/14
modified: 2021/04/28
references:
    - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
logsource:
    product: linux
detection:
    keyword: 
        - '(){:;};'
        - '() {:;};'
        - '() { :;};'
        - '() { :; };'
    condition: keyword
falsepositives:
    - Unknown
level: high
Rule: Shellshock Regex detection 2017-03-14 14:53:29 +01:00			`title: Shellshock Expression`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`status: experimental`
Rule: Shellshock Regex detection 2017-03-14 14:53:29 +01:00			`description: Detects shellshock expressions in log files`
fix: fixed missing date fields in other files 2020-01-30 15:32:39 +01:00			`author: Florian Roth`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`date: 2017/03/14`
fix: shellshock expression 2021-04-28 11:46:49 +02:00			`modified: 2021/04/28`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
fix: shellshock expression 2021-04-28 11:46:49 +02:00			`- https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf`
Rule: Shellshock Regex detection 2017-03-14 14:53:29 +01:00			`logsource:`
			`product: linux`
			`detection:`
fix: shellshock expression 2021-04-28 11:46:49 +02:00			`keyword:`
refactor: extended shellshock rule 2021-04-28 11:47:24 +02:00			`- '(){:;};'`
			`- '() {:;};'`
fix: shellshock expression 2021-04-28 11:46:49 +02:00			`- '() { :;};'`
			`- '() { :; };'`
			`condition: keyword`
Rule: Shellshock Regex detection 2017-03-14 14:53:29 +01:00			`falsepositives:`
			`- Unknown`
			`level: high`