Linux Log Shellshock Expression Pattern Matching

Identifies Shellshock-style function-body expressions in Linux log data via keyword string matches.

FreeReviewedSigma · High · v3

Product: linux
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-03-14
Updated: 2026-07-31

ATT&CK techniques

Persistence

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Shellshock-style function expression sequences appearing in Linux log files, including variations of (){:;}; and spaced variants. Such payload markers are used to trigger Bash function parsing behavior and can indicate attempted command injection. The detection relies on keyword matches in available text-based telemetry from Linux logging sources.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange

Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)

Malicious Web Server Process Spawning Command Interpreter via Web Shell (via process_creation)

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Suspicious PHP Webshell Access with Hardcoded Key

Suspicious IIS Configuration Reconnaissance via Appcmd (via process_creation)

Malicious ManagementMailboxPicker Webshell Written by Diplomatic Specter

Malicious MOVEit human2 Webshell File Creation via file_event

Linux Log Shellshock Expression Pattern Matching

Pivot detection · T1505.003 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-shellshock-function-body-expression-strings-in-logs-c67e0c98

title: Linux Log Shellshock Expression Pattern Matching
id: 7fb5718c-fed8-4332-9d26-6b1335a117ab
status: test
description: This rule flags Shellshock-style function expression sequences appearing in Linux log files, including variations of (){:;}; and spaced variants. Such payload markers are used to trigger Bash function parsing behavior and can indicate attempted command injection. The detection relies on keyword matches in available text-based telemetry from Linux logging sources.
references:
  - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shellshock.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-14
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  product: linux
detection:
  keywords:
    - (){:;};
    - () {:;};
    - () { :;};
    - () { :; };
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL