Sigma rule: OMIGOD SCX RunAsProvider ExecuteScript

Rule

Title

OMIGOD SCX RunAsProvider ExecuteScript

Status

experimental

Level

high

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Date

2021/09/18

Modified

2021/11/11

File

unsupported/linux/lnx_auditd_omigod_scx_runasprovider_executescript.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell. Script being executed gets created as a temp file in /tmp folder with a scx* prefix. Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/. The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

Log source

product

linux

service

auditd

Detection

selection:
    type: 'SYSCALL'
    syscall: 'execve'
    uid: '0'
    cwd: '/var/opt/microsoft/scx/tmp'
    cmdline|contains: /etc/opt/microsoft/scx/conf/tmpdir/scx
    comm: 'sh'
condition: selection

False positives (as the rule lists them)

• Legitimate use of SCX RunAsProvider ExecuteScript.

Tags

• attack.privilege_escalation
• attack.initial_access
• attack.execution
• attack.t1068
• attack.t1190
• attack.t1203

MITRE ATT&CK ids this rule names

• T1068
• T1190
• T1203

References

• https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
• https://censys.io/blog/understanding-the-impact-of-omigod-cve-2021-38647/
• https://github.com/Azure/Azure-Sentinel/pull/3071/files

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/linux/lnx_auditd_omigod_scx_runasprovider_executescript.yml