OMIGOD SCX RunAsProvider ExecuteScript Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

This rule detects the execution of a script via the SCX RunAsProvider ExecuteScript function, which is associated with the OMIGOD vulnerability. Specifically, it looks for process creation events where the user is 'root', the LogonId is '0', the CurrentDirectory is '/var/opt/microsoft/scx/tmp', and the CommandLine contains '/etc/opt/microsoft/scx/conf/tmpdir/scx'. This pattern indicates the execution of a temporary script created by the SCX agent, often exploited for privilege escalation or initial access.