ExtraHop named a Leader in the 2025 Forrester Wave™: Network Analysis And Visibility Solutions

Search
  • Platformchevron right
  • Solutionschevron right
  • Modern NDRchevron right
  • Resourceschevron right
  • Companychevron right

DETECTION OVERVIEW

Shellshock DHCP Exploit Attempt

Risk Factors

The Shellshock vulnerability is well known and trivial to exploit. An attacker with network access to a device can remotely run commands to move laterally across the network.

Category

Exploitation
Detection diagram
Next in Exploitation: Shellshock HTTP Exploit Attempt

Attack Background

Shellshock is a remote code execution (RCE) vulnerability in the Bourne-Again shell (Bash) that attackers have been exploiting since 2014. An attacker-controlled DHCP server is configured to send a response with a Shellshock payload to a DHCP client, which often runs with elevated privileges that allow the client to modify network interfaces. The malicious payload includes a specific DHCP option with code that has a syntax similar to () { :;}; <exploit command>. The malicious command runs in Bash and creates a shell. The attacker then connects to the shell to remotely run commands on the DHCP client.

Mitigation Options

Update Bash to 4.3 or later

MITRE ATT&CK ID

Associated content

Announcing The Forrester Wave™: Network Analysis And Visibility Solutions, Q4 2025

Network analysis and visibility solutions remain underrepresented in enterprises. Find out why in this preview of a new Wave report.

Report

ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response — ExtraHop

ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response

News

Detections

Visit this resource for more information.

Docs

The 2025 ExtraHop Global Threat Landscape Report: The Alarming Reality of Threat Actor Dwell Time and Deeper Network Access — ExtraHop

This analysis exposes the critical link between an organization&#x27;s lack of internal visibility and the escalating cost of compromise, demanding an urgent re-evaluation of how core business assets are protected.

Blog

ExtraHop RevealX MITRE ATT&CK Coverage 2024 — ExtraHop

Learn why you need to be wary of the claims certain network detection and response providers make about their coverage against the MITRE ATT&CK framework.

Blog

MITRE ATT&CK - Network Detection & Response with RevealX — ExtraHop

Learn how NDR from RevealX helps security teams detect and investigate more adversary TTPs in the MITRE ATT&CK framework than rule-based tools.

External
Periodic Table of Use Cases

What else can RevealX do for you?