Detect any ELF executable

[stephengun]

I would like to block any ELF executable, but this is not support in file blocking. I have tried to achieve this using two methods:

Create a custom data pattern. This didn't really work out, as the minimum string length is 7 bytes, but the file identifier is only four, plus it needs to be in the start of the file rather than anywhere in the file.

Create a custom vulnerability. This is ok, but not ideal. I created a pattern-match condition, with a context of file-elf-body. Unfortunately, I then need to add a 7 byte value to match against. I have put \x00000000000000\x, which catches any file I can find, but it is concievable that there are files with no such string.

Can anyone else suggest a better solution to this? You may have guessed, I'm a complete novice at this.

[BenjAudy.MTL · Accepted solution]

Hi,

You could try to do a pattern match on the context "file-unknown-body", with 4 7-byte patterns representing the different classes (32-bit or 64-bit) and endianness (little endian or big endian):

\x7f454c46010101\x

\x7f454c46010201\x

\x7f454c46020101\x

\x7f454c46020201\x

I haven't tried it myself, but I don't see why it wouldn't work.

Regards,

Benjamin

[BenjAudy.MTL]

It looks like content update 667 added a new file type to detect ELF files (ID #52175).

Benjamin