OMIGOD SCX RunAsProvider ExecuteShellCommand

Status: test
Severity: high
Log source: category process_creation, product linux
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Source: github.com/SigmaHQ/sigma

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.

Known false positives

Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Execution	`T1203` Exploitation for Client Execution
Privilege Escalation	`T1068` Exploitation for Privilege Escalation

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: OMIGOD SCX RunAsProvider ExecuteShellCommand
id: 21541900-27a9-4454-9c4c-3f0a4240344a
status: test
description: |
    Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
    SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
    Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
references:
    - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
    - https://github.com/Azure/Azure-Sentinel/pull/3059
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-10-15
modified: 2022-10-05
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.execution
    - attack.t1068
    - attack.t1190
    - attack.t1203
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        User: root
        LogonId: 0
        CurrentDirectory: '/var/opt/microsoft/scx/tmp'
        CommandLine|contains: '/bin/sh'
    condition: selection
falsepositives:
    - Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    User: root
    LogonId: 0
    CurrentDirectory: '/var/opt/microsoft/scx/tmp'
    CommandLine|contains: '/bin/sh'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/bin/sh`	`field:"CommandLine" kind:match value:"/bin/sh"`
`CurrentDirectory`	eq	`/var/opt/microsoft/scx/tmp`	`field:"CurrentDirectory" kind:eq value:"/var/opt/microsoft/scx/tmp"`
`LogonId`	eq	`0`	`field:"LogonId" kind:eq value:"0"`
`User`	eq	`root`	`field:"user" kind:eq value:"root"`