Linux Process Command-Line Indicators of Apache Spark Shell Command Injection Attempt
Alerts on Linux process creation where a bash-spawned command line contains `id -Gn ` injection-like backtick or quote patterns.
- Product
- linux
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Linux process creation events where a parent shell process launches a command containing shell substitution patterns tied to executing the `id -Gn` command. Attackers can use Spark shell command injection to run arbitrary commands on the host, so these command-line constructs are strong signals of exploitation attempts. The detection relies on process creation telemetry, specifically the parent process image name and the child process command line contents.
Reporting behind it
- github.comhttps://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
- sumsec.mehttps://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
- github.comhttps://github.com/apache/spark/pull/36315/files
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Command-Line Indicators of Apache Spark Shell Command Injection Attempt
id: c58793a8-b7ed-4e8f-91a2-473aeb1f4745
status: test
description: This rule identifies Linux process creation events where a parent shell process launches a command containing shell substitution patterns tied to executing the `id -Gn` command. Attackers can use Spark shell command injection to run arbitrary commands on the host, so these command-line constructs are strong signals of exploitation attempts. The detection relies on process creation telemetry, specifically the parent process image name and the child process command line contents.
references:
- https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
- https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
- https://github.com/apache/spark/pull/36315/files
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-20
tags:
- attack.initial-access
- attack.t1190
- cve.2022-33891
- detection.emerging-threats
logsource:
product: linux
category: process_creation
detection:
selection:
ParentImage|endswith: \bash
CommandLine|contains:
- id -Gn `
- id -Gn '
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: c8a5f584-cdc8-42cc-8cce-0398e4265de3
type: derived