title: Shellshock Expression
description: Detects shellshock expressions in log files
reference: http://rubular.com/r/zxBfjWfFYs
logsource:
    product: linux
detection:
    expression: /\(\)\s*\t*\{.*;\s*\}\s*;/ 
    condition: expression
falsepositives:
    - Unknown
level: high