Linux Log Shellshock Expression Pattern Matching
Identifies Shellshock-style function-body expressions in Linux log data via keyword string matches.
- Product
- linux
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-03-14
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Shellshock-style function expression sequences appearing in Linux log files, including variations of (){:;}; and spaced variants. Such payload markers are used to trigger Bash function parsing behavior and can indicate attempted command injection. The detection relies on keyword matches in available text-based telemetry from Linux logging sources.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Log Shellshock Expression Pattern Matching
id: 7fb5718c-fed8-4332-9d26-6b1335a117ab
status: test
description: This rule flags Shellshock-style function expression sequences appearing in Linux log files, including variations of (){:;}; and spaced variants. Such payload markers are used to trigger Bash function parsing behavior and can indicate attempted command injection. The detection relies on keyword matches in available text-based telemetry from Linux logging sources.
references:
- https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shellshock.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-14
modified: 2022-10-09
tags:
- attack.persistence
- attack.t1505.003
logsource:
product: linux
detection:
keywords:
- (){:;};
- () {:;};
- () { :;};
- () { :; };
condition: keywords
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e
type: derived