Apache Spark Shell Command Injection (CVE-2022-33891) via Process Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects attempts to exploit Apache Spark shell command injection vulnerabilities, specifically CVE-2022-33891, by monitoring for suspicious command-line executions involving 'id -Gn' as a child process of a bash shell. This indicates an attacker successfully injecting commands into the Spark environment.