-
Cupsd or Foomatic-rip Shell Execution
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Use Case: Vulnerability Tactic: Execution Data Source: Elastic Defend Data Source: Crowdstrike Data Source: SentinelOne Data Source: Elastic Endgame Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2024-47076 Vuln: CVE-2024-47175 Vuln: CVE-2024-47176 Vuln: CVE-2024-47177 ·This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
Read More -
File Creation by Cups or Foomatic-rip Child
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Use Case: Vulnerability Tactic: Execution Data Source: Elastic Defend Data Source: SentinelOne Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2024-47076 Vuln: CVE-2024-47175 Vuln: CVE-2024-47176 Vuln: CVE-2024-47177 ·This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious file creation events executed by child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
Read More -
Network Connection by Cups or Foomatic-rip Child
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Use Case: Vulnerability Tactic: Command and Control Data Source: Elastic Defend Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2024-47076 Vuln: CVE-2024-47175 Vuln: CVE-2024-47176 Vuln: CVE-2024-47177 ·This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects network connections initiated by a child processes of foomatic-rip. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
Read More -
Printer User (lp) Shell Execution
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Use Case: Vulnerability Tactic: Execution Data Source: Crowdstrike Data Source: Elastic Defend Data Source: Elastic Endgame Data Source: SentinelOne Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2024-47076 Vuln: CVE-2024-47175 Vuln: CVE-2024-47176 Vuln: CVE-2024-47177 ·This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the foomatic-rip parent process through the default printer user (lp). These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
Read More -
Suspicious Execution from Foomatic-rip or Cupsd Parent
Sep 19, 2026 · Domain: Endpoint OS: Linux Use Case: Threat Detection Use Case: Vulnerability Tactic: Execution Data Source: Elastic Defend Data Source: Crowdstrike Data Source: SentinelOne Data Source: Elastic Endgame Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Linux Vuln: CVE-2024-47076 Vuln: CVE-2024-47175 Vuln: CVE-2024-47176 Vuln: CVE-2024-47177 ·This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious process command lines executed by child processes of foomatic-rip and cupsd. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated.
Read More