Let me start by saying I am brand new to Splunk, and not a programmer by profession, but I am surprised that this question has not been discussed. "What query would I run to see if someone has used the ShellShock vulnerability to attack my system?" I think there must be an answer because the blog discussion on how to ensure that all devices are patched for ShellShock starts with the following: "I’ll let others tell you how you could use Splunk to search through your various logs for evidence that evildoers are trying to exploit this in your environment." Thanks ... View more