RLSA-2026-68549: Rocky Linux 8 Firefox 'Important' Security Update — Detection and Remediation Guide

---
title: Firefox Spawning Suspicious Child Process on Linux
id: 3b8c2d14-6f71-4a9e-b5d2-8e7f4a1c9d3b
status: experimental
description: Detects Firefox spawning shells, interpreters, or download tools — a hallmark of successful browser exploitation and post-exploitation on Linux hosts.
references:
  - https://linuxsecurity.com/advisories/rockylinux/rocky-firefox-rlsa-2026-68549
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/firefox'
      - '/firefox-esr'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — legitimate extensions or external handler configurations; investigate any hit
level: high
---
title: Browser Process Writing to Linux Persistence Locations
id: 9d4f1e72-8c3a-4b6d-a2e9-5f7c1d8b3e6a
status: experimental
description: Detects Firefox writing executables or scripts to persistence-related paths such as systemd user units, autostart directories, or cron locations — indicative of post-exploitation persistence after browser compromise.
references:
  - https://linuxsecurity.com/advisories/rockylinux/rocky-firefox-rlsa-2026-68549
  - https://attack.mitre.org/techniques/T1053/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1053
  - attack.t1543
logsource:
  category: file_event
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/firefox'
      - '/firefox-esr'
  selection_path:
    TargetFilename|contains:
      - '/.config/autostart/'
      - '/.config/systemd/user/'
      - '/etc/cron'
      - '/var/spool/cron'
      - '/.bashrc'
      - '/.profile'
  condition: selection_image and selection_path
falsepositives:
  - Firefox update or extension installation writing autostart entries on some desktop environments
level: high
---
title: Outbound Connection from Shell Spawned by Browser
id: 5e2a9c41-7d8b-4f3e-91a6-2c4d7b8e5f1a
status: experimental
description: Detects network connections initiated by shell or interpreter processes whose parent is a browser process tree — a strong signal of reverse shell or C2 establishment following browser exploitation.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1059
logsource:
  category: network_connection
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/firefox'
      - '/firefox-esr'
  selection_image:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/python3'
      - '/nc'
      - '/ncat'
  selection_external:
    DestinationIp|cidr: '0.0.0.0/0'
  filter_private:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_parent and selection_image and selection_external and not filter_private
falsepositives:
  - Extremely rare in normal operation
level: critical

// Hunt 1: Firefox spawning suspicious child processes (Sysmon for Linux / auditd via Syslog)
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "user" or SyslogMessage has "firefox"
| where SyslogMessage has_all ("firefox", "execve")
     or SyslogMessage has_any ("/bin/bash", "/bin/sh", "/usr/bin/python3", "/usr/bin/curl", "/usr/bin/wget")
| where SyslogMessage has "firefox"
| extend ChildProcess = extract(@"Image=([^\s]+)", 1, SyslogMessage)
| extend ParentProcess = extract(@"ParentImage=([^\s]+)", 1, SyslogMessage)
| summarize count() by Computer, ChildProcess, ParentProcess, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

// Hunt 2: Identify hosts with unpatched Firefox via Defender software inventory (if MDE is deployed on Linux)
DeviceTvmSoftwareInventory
| where SoftwareName has "firefox"
| summarize arg_max(TimeGenerated, *) by DeviceName, SoftwareName, SoftwareVersion
| project DeviceName, SoftwareName, SoftwareVersion, LastSeen = TimeGenerated
| order by SoftwareVersion asc;

-- Artifact: Rocky Linux Firefox version and suspicious child process hunt
-- 1) Installed Firefox package version (RPM)
SELECT Name, Version, Release, InstallTime
FROM rpm_packages()
WHERE Name =~ 'firefox'

-- 2) Live processes: Firefox children that should not exist
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'firefox'
   OR Name =~ '(bash|sh|python3?|perl|curl|wget|nc|ncat|socat)$'

-- 3) Persistence artifacts written recently in common user-level locations
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/home/*/.config/autostart/*', '/home/*/.config/systemd/user/*'])
WHERE Mtime > (now() - 604800)  -- modified within the last 7 days

#!/bin/bash
# RLSA-2026-68549 remediation and verification — Rocky Linux 8
# Applies the Firefox security update and verifies the installed package

set -euo pipefail

ADVISORY="RLSA-2026-68549"
echo "[+] Current installed Firefox package:"
rpm -q firefox || { echo "[!] Firefox not installed on this host."; exit 0; }

echo "[+] Refreshing repository metadata..."
dnf clean all
dnf makecache

echo "[+] Checking for applicable security advisories for this host..."
dnf updateinfo list security 2>/dev/null | grep -i firefox || echo "    (no firefox-specific advisory listed; proceeding with update)"

echo "[+] Applying Firefox update..."
dnf update -y firefox

echo "[+] Post-update installed version:"
NEW_VER=$(rpm -q firefox)
echo "    ${NEW_VER}"

echo "[+] Verification: ensure Firefox is not still running the old binary..."
if pgrep -x firefox >/dev/null 2>&1; then
    echo "[!] WARNING: Firefox processes are still running with the pre-update binary."
    echo "    Restart Firefox (or the user session) to load the patched code."
    pgrep -ax firefox
else
    echo "[+] No running Firefox processes. Patch effective on next launch."
fi

echo "[+] Done. Confirm this host's package version against the fixed version"
echo "    listed in ${ADVISORY} at: https://linuxsecurity.com/advisories/rockylinux/rocky-firefox-rlsa-2026-68549"