Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Alert on HTTP 200 POST /wsman with no Authorization header and a non-empty body in Zeek logs, consistent with OMIGOD unauthenticated RCE attempts.

FreeReviewedSigma · High · v5

Product: zeek
Service: http
Author: Nate Guagenti (neu5ron) (SigmaHQ), DRL 1.1
Published: 2021-09-20
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Lateral Movement

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
- T1068Exploitation for Privilege Escalation
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.006Windows Remote Management
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Zeek-observed HTTP traffic where a POST request to /wsman returns HTTP 200 without an Authorization header and with a non-empty HTTP client request body. This pattern is consistent with unauthenticated exploitation attempts that can lead to remote command execution as root, so alerting helps catch successful attack attempts that may not otherwise be obvious from headers alone. Telemetry relies on Zeek HTTP logs for status code, URI, HTTP method, presence of the Authorization header, and request body length, and it expects investigators to validate the request body and surrounding endpoint activity during the request timeframe.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Malicious OMI Server Spawning Shell as Root via OMIGOD SCX Provider (via process_creation)

Windows Process Creation: Suspicious cmd.exe or PowerShell Child of WSUS (wsusservice.exe)

Windows Application Logs: Detect WSUS deserialization exploitation via InvalidCastException indicators

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Windows spoolsv.exe Child Process Execution Indicators

Windows Terminal Service Parent Process Spawn (svchost.exe termsvcs)

Apache thread assertion error in error.log

Suspicious Child Process Spawned by WinRAR via Process Creation

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

zeek-http-post-to-wsman-without-authorization-header-indicates-omigod-rce-attemp-ab6b1a39

title: Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)
id: bf0d10e0-3e3a-4ae0-8aa1-4aeba3089ea3
status: stable
description: This rule flags Zeek-observed HTTP traffic where a POST request to /wsman returns HTTP 200 without an Authorization header and with a non-empty HTTP client request body. This pattern is consistent with unauthenticated exploitation attempts that can lead to remote command execution as root, so alerting helps catch successful attack attempts that may not otherwise be obvious from headers alone. Telemetry relies on Zeek HTTP logs for status code, URI, HTTP method, presence of the Authorization header, and request body length, and it expects investigators to validate the request body and surrounding endpoint activity during the request timeframe.
references:
  - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
  - https://twitter.com/neu5ron/status/1438987292971053057?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml
author: Nate Guagenti (neu5ron), Huntrule Team
date: 2021-09-20
modified: 2025-11-03
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.execution
  - attack.lateral-movement
  - attack.t1068
  - attack.t1190
  - attack.t1203
  - attack.t1021.006
  - attack.t1210
  - detection.emerging-threats
  - cve.2021-38647
logsource:
  product: zeek
  service: http
  definition: Enable the builtin Zeek script that logs all HTTP header names by adding "@load policy/protocols/http/header-names" to your local.zeek config file. The script can be seen here for reference https://github.com/zeek/zeek/blob/d957f883df242ef159cfd846884e673addeea7a5/scripts/policy/protocols/http/header-names.zeek
detection:
  selection:
    status_code: 200
    uri: /wsman
    method: POST
  auth_header:
    client_header_names|contains: AUTHORIZATION
  too_small_http_client_body:
    request_body_len: 0
  condition: selection and not auth_header and not too_small_http_client_body
falsepositives:
  - Exploits that were attempted but unsuccessful.
  - Scanning attempts with the abnormal use of the HTTP POST method with no indication of code execution within the HTTP Client (Request) body. An example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. See description for investigation tips.
level: high
license: DRL-1.1
related:
  - id: ab6b1a39-a9ee-4ab4-b075-e83acf6e346b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL