OPSSHIELD cPGuard update channel hijacked: fake updates ran as root on ~2,950 Linux hosting servers
https://sockanalyst.com/patch-now/opsshield-cpguard-update-channel-compromise

Splunk
index=linux (sourcetype=linux:audit OR sourcetype=syslog OR sourcetype=sysmon:linux OR sourcetype="cpguard*")
  ("cpguard-v58812-i91511.sh" OR ".cpg91511_sh" OR "/var/tmp/.cpg91511" OR "loot.tgz" OR "i93677"
   OR ("Successfully updated to 5.88.1*"))
| rex field=_raw "Successfully updated to (?<cpg_version>5\.88\.\d+)"
| eval bad_version=if(match(cpg_version,"^5\.88\.1[2-9]$"),"yes",null())
| stats count min(_time) as first max(_time) as last values(cpg_version) as versions values(bad_version) as bad by host
// Any hit = host touched by the fake cPGuard update; rotate root secrets and SSH keys

Sentinel
let iocs = dynamic(["cpguard-v58812-i91511.sh", ".cpg91511_sh", "/var/tmp/.cpg91511", "loot.tgz", "i93677"]);
union isfuzzy=true
  (Syslog | where TimeGenerated > ago(30d) | where SyslogMessage has_any (iocs) or SyslogMessage matches regex @"Successfully updated to 5\.88\.1[2-9]\b" | project TimeGenerated, Computer, Evidence=SyslogMessage),
  (DeviceFileEvents | where TimeGenerated > ago(30d) | where FolderPath has_any (iocs) or FileName has_any (iocs) | project TimeGenerated, Computer=DeviceName, Evidence=strcat(ActionType, " ", FolderPath, FileName)),
  (DeviceProcessEvents | where TimeGenerated > ago(30d) | where ProcessCommandLine has_any (iocs) or (InitiatingProcessFolderPath has "/opt/cpguard" and ProcessCommandLine has_any ("/etc/shadow", "/root/.ssh", ".my.cnf", ".bash_history")) | project TimeGenerated, Computer=DeviceName, Evidence=ProcessCommandLine)
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Evidence=make_set(Evidence, 10) by Computer
// Hosts with cPGuard IOC paths, bad 5.88.12-5.88.19 installs, or cPGuard reading root secrets