huntrule

Linux Process Command-Line Indicators of Apache Spark Shell Command Injection Attempt

Alerts on Linux process creation where a bash-spawned command line contains `id -Gn ` injection-like backtick or quote patterns.

FreeReviewedSigma · High · v5
Product
linux
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-07-20
Updated
2026-07-31
AnalysisDetection
title: Linux Process Command-Line Indicators of Apache Spark Shell Command Injection Attempt
id: c58793a8-b7ed-4e8f-91a2-473aeb1f4745
status: test
description: This rule identifies Linux process creation events where a parent shell process launches a command containing shell substitution patterns tied to executing the `id -Gn` command. Attackers can use Spark shell command injection to run arbitrary commands on the host, so these command-line constructs are strong signals of exploitation attempts. The detection relies on process creation telemetry, specifically the parent process image name and the child process command line contents.
references:
  - https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
  - https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
  - https://github.com/apache/spark/pull/36315/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-20
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-33891
  - detection.emerging-threats
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \bash
    CommandLine|contains:
      - id -Gn `
      - id -Gn '
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c8a5f584-cdc8-42cc-8cce-0398e4265de3
    type: derived