Zeek HTTP POST to /wsman Without Authorization Header Indicates OMIGOD RCE Attempt (CVE-2021-38647)

Alert on HTTP 200 POST /wsman with no Authorization header and a non-empty body in Zeek logs, consistent with OMIGOD unauthenticated RCE attempts.

FreeUnreviewedSigmahighv1

zeek-http-post-to-wsman-without-authorization-header-indicates-omigod-rce-attemp-ab6b1a39

title: Zeek HTTP POST to /wsman Without Authorization Header Indicates OMIGOD RCE Attempt (CVE-2021-38647)
id: bf0d10e0-3e3a-4ae0-8aa1-4aeba3089ea3
status: stable
description: This rule flags Zeek-observed HTTP traffic where a POST request to /wsman returns HTTP 200 while lacking an Authorization header and having a non-empty request body. This pattern can indicate exploitation attempts against OMIGOD (CVE-2021-38647), where an unauthenticated request may trigger remote command execution. It relies on Zeek HTTP logs for status code, method, URI, request body length, and HTTP client header names to support triage and investigation.
references:
  - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
  - https://twitter.com/neu5ron/status/1438987292971053057?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml
author: Nate Guagenti (neu5ron), Huntrule Team
date: 2021-09-20
modified: 2025-11-03
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.execution
  - attack.lateral-movement
  - attack.t1068
  - attack.t1190
  - attack.t1203
  - attack.t1021.006
  - attack.t1210
  - detection.emerging-threats
  - cve.2021-38647
logsource:
  product: zeek
  service: http
  definition: Enable the builtin Zeek script that logs all HTTP header names by adding "@load policy/protocols/http/header-names" to your local.zeek config file. The script can be seen here for reference https://github.com/zeek/zeek/blob/d957f883df242ef159cfd846884e673addeea7a5/scripts/policy/protocols/http/header-names.zeek
detection:
  selection:
    status_code: 200
    uri: /wsman
    method: POST
  auth_header:
    client_header_names|contains: AUTHORIZATION
  too_small_http_client_body:
    request_body_len: 0
  condition: selection and not auth_header and not too_small_http_client_body
falsepositives:
  - Exploits that were attempted but unsuccessful.
  - Scanning attempts with the abnormal use of the HTTP POST method with no indication of code execution within the HTTP Client (Request) body. An example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. See description for investigation tips.
level: high
license: DRL-1.1
related:
  - id: ab6b1a39-a9ee-4ab4-b075-e83acf6e346b
    type: derived

What it detects

This rule flags Zeek-observed HTTP traffic where a POST request to /wsman returns HTTP 200 while lacking an Authorization header and having a non-empty request body. This pattern can indicate exploitation attempts against OMIGOD (CVE-2021-38647), where an unauthenticated request may trigger remote command execution. It relies on Zeek HTTP logs for status code, method, URI, request body length, and HTTP client header names to support triage and investigation.

Known false positives

Exploits that were attempted but unsuccessful.
Scanning attempts with the abnormal use of the HTTP POST method with no indication of code execution within the HTTP Client (Request) body. An example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. See description for investigation tips.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.