Linux ProcessCreation: Apache Spark shell command injection indicators via `id -Gn `

title: "Linux ProcessCreation: Apache Spark shell command injection indicators via `id -Gn `"
id: c58793a8-b7ed-4e8f-91a2-473aeb1f4745
status: test
description: This rule flags process creation events where the parent process name ends with "bash" and the child process command line contains command-injection-style patterns using backticks or single quotes around `id -Gn`. Attackers may use these constructs to execute injected shell commands in the context of an Apache Spark shell session. It relies on Linux process creation telemetry with ParentImage and CommandLine fields to identify the suspicious parent-child execution pattern.
references:
  - https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
  - https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
  - https://github.com/apache/spark/pull/36315/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-20
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-33891
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \bash
    CommandLine|contains:
      - id -Gn `
      - id -Gn '
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c8a5f584-cdc8-42cc-8cce-0398e4265de3
    type: derived