Suspicious Invocation of Shell via Rsync (CVE-2024-12084)

SigmaHQ Detections@sigmaHQ

•updated Jan 19, 2025•3•0•20

Detects the execution of a shell as a sub-process of "rsync" without the expected command line flag "-e" being used. This behavior is commonly associated with attempts to exploit CVE-2024-12084, leading to arbitrary command execution or privilege escalation.