Linux Shellshock Function-Body Expression Strings in Logs

Identifies Shellshock-style function-body expressions in Linux log data via keyword string matches.

FreeUnreviewedSigmahighv1

linux-shellshock-function-body-expression-strings-in-logs-c67e0c98

title: Linux Shellshock Function-Body Expression Strings in Logs
id: 7fb5718c-fed8-4332-9d26-6b1335a117ab
status: test
description: This rule flags log lines containing common Shellshock function-body expression patterns such as '(){:;};' and variants with optional spaces. Attackers may use these expressions to trigger unintended command execution via vulnerable shell parsing behavior, making these strings high-signal for exploitation attempts. Detection relies on keyword matching against the provided Linux log content.
references:
  - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shellshock.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-14
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
detection:
  keywords:
    - (){:;};
    - () {:;};
    - () { :;};
    - () { :; };
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e
    type: derived

What it detects

This rule flags log lines containing common Shellshock function-body expression patterns such as '(){:;};' and variants with optional spaces. Attackers may use these expressions to trigger unintended command execution via vulnerable shell parsing behavior, making these strings high-signal for exploitation attempts. Detection relies on keyword matching against the provided Linux log content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.