OMIGOD SCX RunAsProvider ExecuteShellCommand Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.