topic Detect any ELF executable in Custom Signatures

Detect any ELF executable

stephengun — Fri, 05 Aug 2016 01:18:38 GMT

I would like to block any ELF executable, but this is not support in file blocking. I have tried to achieve this using two methods:

Create a custom data pattern. This didn't really work out, as the minimum string length is 7 bytes, but the file identifier is only four, plus it needs to be in the start of the file rather than anywhere in the file.

Create a custom vulnerability. This is ok, but not ideal. I created a pattern-match condition, with a context of file-elf-body. Unfortunately, I then need to add a 7 byte value to match against. I have put \x00000000000000\x, which catches any file I can find, but it is concievable that there are files with no such string.

Can anyone else suggest a better solution to this? You may have guessed, I'm a complete novice at this.

Re: Detect any ELF executable

BenjAudy.MTL — Fri, 05 Aug 2016 18:28:23 GMT

Hi,

You could try to do a pattern match on the context "file-unknown-body", with 4 7-byte patterns representing the different classes (32-bit or 64-bit) and endianness (little endian or big endian):

\x7f454c46010101\x

\x7f454c46010201\x

\x7f454c46020101\x

\x7f454c46020201\x

I haven't tried it myself, but I don't see why it wouldn't work.

Regards,

Benjamin

Re: Detect any ELF executable

BenjAudy.MTL — Thu, 02 Mar 2017 15:50:36 GMT

It looks like content update 667 added a new file type to detect ELF files (ID #52175).

Benjamin