Sigma rule: OMIGOD HTTP No Authentication RCE - CVE-2021-38647

Rule

Title

OMIGOD HTTP No Authentication RCE - CVE-2021-38647

Status

stable

Level

high

Author

Nate Guagenti (neu5ron)

Date

2021-09-20

Modified

2025-11-03

File

rules-emerging-threats/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.
Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).
Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Log source

product

zeek

service

http

definition

Enable the builtin Zeek script that logs all HTTP header names by adding "@load policy/protocols/http/header-names" to your local.zeek config file. The script can be seen here for reference https://github.com/zeek/zeek/blob/d957f883df242ef159cfd846884e673addeea7a5/scripts/policy/protocols/http/header-names.zeek

Detection

selection:
    status_code: 200
    uri: /wsman
    method: POST
auth_header:
    client_header_names|contains: 'AUTHORIZATION'
too_small_http_client_body:
    request_body_len: 0
# winrm_ports:
#    id.resp_p:
#        -  5985
#        -  5986
#        -  1270
condition: selection and not auth_header and not too_small_http_client_body
# condition: selection and winrm_ports and not auth_header and not too_small_http_client_body # Enable this to only perform search on default WinRM ports, however those ports are sometimes changed and therefore this is disabled by default to give a broader coverage of this rule

False positives (as the rule lists them)

• Exploits that were attempted but unsuccessful.
• Scanning attempts with the abnormal use of the HTTP POST method with no indication of code execution within the HTTP Client (Request) body. An example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. See description for investigation tips.

Tags

• attack.privilege-escalation
• attack.initial-access
• attack.execution
• attack.lateral-movement
• attack.t1068
• attack.t1190
• attack.t1203
• attack.t1021.006
• attack.t1210
• detection.emerging-threats
• cve.2021-38647

CVEs this rule names

• CVE-2021-38647

MITRE ATT&CK ids this rule names

• T1021.006
• T1068
• T1190
• T1203
• T1210

References

• https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
• https://twitter.com/neu5ron/status/1438987292971053057?s=20

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml