Shellshock Expression

Title: Shellshock Expression
Status: test
Description:Detects shellshock expressions in log files
References:
  -https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
Author: Florian Roth (Nextron Systems)
Date: 2017-03-14
modified:2022-10-09
Tags:

• -'attack.persistence'
• -'attack.t1505.003'

Logsource:

• product: linux

Detection:
  keywords:
    - '(){:;};'
    - '() {:;};'
    - '() { :;};'
    - '() { :; };'
  condition:keywords
Falsepositives:
  -Unknown
Level: high