← Back to SOC feed Coverage →

OMIGOD SCX RunAsProvider ExecuteShellCommand

sigma HIGH SigmaHQ
T1068T1190T1203
imProcessCreate
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at SigmaHQ →
Retrieved: 2026-03-25T02:50:08Z · Confidence: medium

Hunt Hypothesis

Adversaries may use the SCX RunAsProvider to execute arbitrary shell commands, leveraging it as a persistence mechanism or to exfiltrate data. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential command and control activities or lateral movement attempts.

Detection Rule

Sigma (Original)

title: OMIGOD SCX RunAsProvider ExecuteShellCommand
id: 21541900-27a9-4454-9c4c-3f0a4240344a
status: test
description: |
    Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
    SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
    Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
references:
    - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
    - https://github.com/Azure/Azure-Sentinel/pull/3059
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-10-15
modified: 2022-10-05
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.execution
    - attack.t1068
    - attack.t1190
    - attack.t1203
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        User: root
        LogonId: 0
        CurrentDirectory: '/var/opt/microsoft/scx/tmp'
        CommandLine|contains: '/bin/sh'
    condition: selection
falsepositives:
    - Legitimate use of SCX RunAsProvider Invoke_ExecuteShellCommand.
level: high

KQL (Azure Sentinel)

imProcessCreate
| where TargetUsername =~ "root" and TargetUserSessionId == 0 and TargetProcessCurrentDirectory =~ "/var/opt/microsoft/scx/tmp" and TargetProcessCommandLine contains "/bin/sh"

False Positive Guidance

MITRE ATT&CK Context

Original source: https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml