Detecting a specific Linux binary(ELF) file using a custom signature

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Detecting a specific Linux binary(ELF) file using a custom signature

L1 Bithead


As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.


It is:


- Not recommended for deployment in a production network of any kind without internal testing.

- Not a solution to any vulnerability.

- Not an official supported Palo Alto Networks signature



This write up is to help the Palo Alto Networks community with detecting a specific linux ELF sample in this example.  


The sample signature was created on PAN OS Version 7.0.x :


Hash256: 92fd1971f7ac512d096821a4bf8553bc13d1c478680999dd2e15400fe8973793


Fill out the appropriate field under the configuration tab

Screen Shot 2016-06-16 at 2.13.38 PM.png


Choose the standard option from the radio button and click on add to create a signature

Screen Shot 2016-06-16 at 4.17.41 PM.png


Since we only have one condition it doesn’t matter if we choose the ‘and’/’or’ condition

Screen Shot 2016-06-16 at 2.19.44 PM.png


Within the ELF file we are looking for a particular pattern on hex values.  Make sure to choose the context type as: file-elf-body

Screen Shot 2016-06-16 at 2.19.53 PM.png


Below is a threat log that is being triggered on this signature

Screen Shot 2016-06-16 at 4.12.44 PM.png


Sample xml signature attached to this document.


L1 Bithead

What is the significance of the Hash?


Hash256: 92fd1971f7ac512d096821a4bf8553bc13d1c478680999dd2e15400fe8973793


Is there any relationship between the hash and the hex string you are testing for?



Screen Shot 2016-06-16 at 2.19.53 PM.png




The hash is mentioned to indicate which sample file was used for this example.


The actual hex pattern in the signature is pulled from this binary's file body.


  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!