Linux: Suspicious root shell spawned by sshd suggesting CVE-2024-3094 exploitation

Alerts on sshd spawning bash/sh one-liners as root, a potential indicator of CVE-2024-3094 style exploitation.

FreeUnreviewedSigmahighv1

linux-suspicious-root-shell-spawned-by-sshd-suggesting-cve-2024-3094-exploitatio-9aa27839

title: "Linux: Suspicious root shell spawned by sshd suggesting CVE-2024-3094 exploitation"
id: 60b4b35f-aaf6-44fb-bb35-14cae695665a
status: test
description: This rule flags Linux process creation events where sshd spawns a shell command via either bash -c or sh -c executed as the root user. Such patterns can indicate post-authentication command execution that may align with exploitation activity. It relies on telemetry that includes parent process path, child command-line content, and the executing user.
references:
  - https://github.com/amlweems/xzbot?tab=readme-ov-file#backdoor-demo
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3094/proc_creation_lnx_exploit_cve_2024_3094_sshd_child_process.yml
author: Arnim Rupp, Nasreddine Bencherchali, Thomas Patzke, Huntrule Team
date: 2024-04-01
modified: 2024-07-03
tags:
  - attack.execution
  - cve.2024-3094
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /sshd
    CommandLine|startswith:
      - bash -c
      - sh -c
    User: root
  condition: selection
falsepositives:
  - Administrative activity directly with root authentication might trigger this rule if it's unnecessarily prefixed with "sh -c" or "bash -c"
level: high
license: DRL-1.1
related:
  - id: 9aa27839-e8ba-4d7a-ac1a-746c22c3d1e5
    type: derived

What it detects

This rule flags Linux process creation events where sshd spawns a shell command via either bash -c or sh -c executed as the root user. Such patterns can indicate post-authentication command execution that may align with exploitation activity. It relies on telemetry that includes parent process path, child command-line content, and the executing user.

Known false positives

Administrative activity directly with root authentication might trigger this rule if it's unnecessarily prefixed with "sh -c" or "bash -c"

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.