Linux sshd Spawns Root Shell Script Commands Suggesting CVE-2024-3094 Exploitation
Alerts on sshd spawning bash/sh one-liners as root, a potential indicator of CVE-2024-3094 style exploitation.
FreeReviewedSigma · High · v5
- Product
- linux
- Category
- process_creation
- Author
- Arnim Rupp, Nasreddine Bencherchali, Thomas Patzke (SigmaHQ), DRL 1.1
- Published
- 2024-04-01
- Updated
- 2026-07-31
What it detects
This rule flags process creation where the parent process is sshd and the child command line starts with either "bash -c" or "sh -c" executed as user root. Such activity can indicate post-authentication command execution behavior consistent with exploitation attempts tied to CVE-2024-3094. It relies on Linux process creation telemetry including parent image path, child command line, and executing user.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-suspicious-root-shell-spawned-by-sshd-suggesting-cve-2024-3094-exploitatio-9aa27839
title: Linux sshd Spawns Root Shell Script Commands Suggesting CVE-2024-3094 Exploitation
id: 60b4b35f-aaf6-44fb-bb35-14cae695665a
status: test
description: This rule flags process creation where the parent process is sshd and the child command line starts with either "bash -c" or "sh -c" executed as user root. Such activity can indicate post-authentication command execution behavior consistent with exploitation attempts tied to CVE-2024-3094. It relies on Linux process creation telemetry including parent image path, child command line, and executing user.
references:
- https://github.com/amlweems/xzbot?tab=readme-ov-file#backdoor-demo
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3094/proc_creation_lnx_exploit_cve_2024_3094_sshd_child_process.yml
author: Arnim Rupp, Nasreddine Bencherchali, Thomas Patzke, Huntrule Team
date: 2024-04-01
modified: 2024-07-03
tags:
- attack.execution
- cve.2024-3094
- detection.emerging-threats
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /sshd
CommandLine|startswith:
- bash -c
- sh -c
User: root
condition: selection
falsepositives:
- Administrative activity directly with root authentication might trigger this rule if it's unnecessarily prefixed with "sh -c" or "bash -c"
level: high
license: DRL-1.1
related:
- id: 9aa27839-e8ba-4d7a-ac1a-746c22c3d1e5
type: derived