Detecting a specific Linux binary(ELF) file using a custom signature

nsheikh — Fri, 17 Jun 2016 19:52:40 GMT

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for deployment in a production network of any kind without internal testing.

- Not a solution to any vulnerability.

- Not an official supported Palo Alto Networks signature

This write up is to help the Palo Alto Networks community with detecting a specific linux ELF sample in this example.

The sample signature was created on PAN OS Version 7.0.x :

Hash256: 92fd1971f7ac512d096821a4bf8553bc13d1c478680999dd2e15400fe8973793

Fill out the appropriate field under the configuration tab

Choose the standard option from the radio button and click on add to create a signature

Since we only have one condition it doesn’t matter if we choose the ‘and’/’or’ condition

Within the ELF file we are looking for a particular pattern on hex values. Make sure to choose the context type as: file-elf-body

Below is a threat log that is being triggered on this signature

Sample xml signature attached to this document.

Re: Detecting a specific Linux binary(ELF) file using a custom signature

stephengun — Thu, 04 Aug 2016 05:14:29 GMT

What is the significance of the Hash?

Hash256: 92fd1971f7ac512d096821a4bf8553bc13d1c478680999dd2e15400fe8973793

Is there any relationship between the hash and the hex string you are testing for?

Re: Detecting a specific Linux binary(ELF) file using a custom signature

goku123 — Thu, 04 Aug 2016 15:55:43 GMT

The hash is mentioned to indicate which sample file was used for this example.

The actual hex pattern in the signature is pulled from this binary's file body.

topic Detecting a specific Linux binary(ELF) file using a custom signature in Custom Signatures

Detecting a specific Linux binary(ELF) file using a custom signature

Re: Detecting a specific Linux binary(ELF) file using a custom signature

Re: Detecting a specific Linux binary(ELF) file using a custom signature