Detecting a specific Linux binary(ELF) file using a custom signature

Reply
L1 Bithead

Detecting a specific Linux binary(ELF) file using a custom signature

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

 

It is:

 

- Not recommended for deployment in a production network of any kind without internal testing.

- Not a solution to any vulnerability.

- Not an official supported Palo Alto Networks signature

 

 

This write up is to help the Palo Alto Networks community with detecting a specific linux ELF sample in this example.  

 

The sample signature was created on PAN OS Version 7.0.x :

 

Hash256: 92fd1971f7ac512d096821a4bf8553bc13d1c478680999dd2e15400fe8973793

 

Fill out the appropriate field under the configuration tab

Screen Shot 2016-06-16 at 2.13.38 PM.png

 

Choose the standard option from the radio button and click on add to create a signature

Screen Shot 2016-06-16 at 4.17.41 PM.png

 

Since we only have one condition it doesn’t matter if we choose the ‘and’/’or’ condition

Screen Shot 2016-06-16 at 2.19.44 PM.png

 

Within the ELF file we are looking for a particular pattern on hex values.  Make sure to choose the context type as: file-elf-body

Screen Shot 2016-06-16 at 2.19.53 PM.png

 

Below is a threat log that is being triggered on this signature

Screen Shot 2016-06-16 at 4.12.44 PM.png

 

Sample xml signature attached to this document.

Highlighted
L1 Bithead

What is the significance of the Hash?

 

Hash256: 92fd1971f7ac512d096821a4bf8553bc13d1c478680999dd2e15400fe8973793

 

Is there any relationship between the hash and the hex string you are testing for?

 

 

Screen Shot 2016-06-16 at 2.19.53 PM.png

 


 

 

Highlighted
L7 Applicator

The hash is mentioned to indicate which sample file was used for this example.

 

The actual hex pattern in the signature is pulled from this binary's file body.

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!