Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•1•0•45

Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.