CVE2021

CVE-2021-38647

1Rules

2References

1Folders

2025-11-03Latest

Summary

CVE-2021-38647 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2021. Coverage centers on zeek / http.

Related Detections

Search this threat

Emerging Threathighstable

OMIGOD HTTP No Authentication RCE - CVE-2021-38647

Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.

Zeek (Bro)http

TA0004 · Privilege EscalationTA0001 · Initial AccessTA0002 · ExecutionTA0008 · Lateral Movement+7

Nate Guagenti (neu5ron)Mon Sep 202021

References