SCX RunAsProvider ExecuteShellCommand

[Cyb3rWard0g]

This hunting query uses Auditd security events collected via the Syslog data connector to explore the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.

SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager. Microsoft Azure, and Microsoft Operations Management Suite.

SCX has a support provider named RunAsProvider. This provider has a few classes:

• ExecuteCommand
• ExecuteShellCommand
• ExecuteScript

Based on OMIGOD: Critical Vulnerabilities in OMI Affecting Countless Azure Customers by Wiz , ExecuteShellCommand was used in the HTTP request to test CVE-2021-38647.

<s:Body>
      <p:ExecuteShellCommand_INPUT xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">
         <p:command>id</p:command>
         <p:timeout>0</p:timeout>
      </p:ExecuteShellCommand_INPUT>
   </s:Body>

This was derived from initial testing while executing commands via /opt/omi/bin/omicli and exploring responses.

/opt/omi/bin/omicli --hostname 192.168.1.1 -u azureuser -p Password1 iv root/scx { SCX_OperatingSystem } ExecuteShellCommand { command 'id' timeout 0 }

Using the same template provided in the blog post by Wiz, we prepared a quick test:

<s:Body>
      <p:ExecuteShellCommand_INPUT xmlns:p="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem">
         <p:command>echo 'Hola MSTIC'</p:command>
         <p:timeout>0</p:timeout>
      </p:ExecuteShellCommand_INPUT>
   </s:Body>

We set the SCX logging to verbose

/opt/microsoft/scx/bin/tools/scxadmin -log-set all verbose

and we were able to capture the activity on the OMI server side in the scx.log:

tail -f /var/opt/microsoft/scx/log/scx.log

Next, we checked our Sysmon for Linux and auditd logs in our lab environment and identified where the commands were being executed from:

We then put together the following query to validate our testing. The query is part of this PR.

References:

• https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
• https://docs.microsoft.com/en-us/system-center/scom/manage-security-administer-crossplat-agent?view=sc-om-2019
• https://github.com/microsoft/SCXcore
• https://github.com/microsoft/SCXcore/blob/master/source/code/providers/support/runasprovider.cpp#L137

[shainw]

1 recommended change and 1 potential change depending on what is in the user fields, otherwise good.