Detects ELF Linux/Torte infection

Hunt Hypothesis

This hypothesis posits that adversaries are deploying ELF Linux malware to establish persistent footholds within our containerized or virtualized infrastructure by exploiting known Torte infection vectors. Proactive hunting in Azure Sentinel is essential to identify early-stage compromises before they escalate into lateral movement events, ensuring we can isolate affected workloads and refine our detection logic for this specific low-severity threat.

YARA Rule

rule ELF_Linux_Torte : Linux ELF

{
    meta:
		author = "@mmorenog,@yararules"
		description = "Detects ELF Linux/Torte infection"
		ref = "http://blog.malwaremustdie.org/2016/01/mmd-0050-2016-incident-report-elf.html"
		hash1 = "1faf27f6b8e8a9cadb611f668a01cf73"
		hash2 = "cb0477445fef9c5f1a5b6689bbfb941e"

    strings:
        $s0 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6)"
        $s1 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.7.6)"
        $s2 = "?sessd="
        $s3 = "&sessc="
        $s4 = "&sessk="
        $s5 = "3a08fe7b8c4da6ed09f21c3ef97efce2"
        $s6 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
        $s7 = "_ZN11CThreadPool10getBatchesERSt6vectorISt4pairISsiESaIS2_EE"
        $s8 = "_ZNSs4_Rep10_M_destroyERKSaIcE@@GLIBCXX_3.4"
        $s9 = "_ZNSt6vectorImSaImEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPmS1_EERKm"
        $s10 = "_ZNSt6vectorISt4pairISsiESaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_"
        $s11 = "_ZSt20__throw_out_of_rangePKc@@GLIBCXX_3.4"
        
        condition:
        is__elf and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 12 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Detects ELF Linux/Torte infection rule, including suggested filters and exclusions:

• Automated Package Management Updates

  • Scenario: The apt or yum package managers frequently download and extract binary archives (ELF files) during scheduled maintenance windows. If these tools are configured to verify signatures immediately upon extraction, the rapid creation and modification of standard ELF binaries in /var/cache/apt/archives/ or /var/lib/yum/packages/ can mimic the file system behavior of an active infection scan.
  • Filter/Exclusion: Exclude file paths matching */var/cache/apt/*, */var/lib/yum/*, and */usr/share/doc/*. Additionally, filter out events where the parent process is apt-get, dpkg, yum, or dnf running under the root user.

• CI/CD Pipeline Artifact Deployment

  • Scenario: Continuous Integration tools like Jenkins, GitLab CI, or Argo CD often pull Docker images or raw binary artifacts into temporary build directories (e.g., /tmp/build-artifacts or /var/jenkins_home/workspace). The extraction of these ELF binaries by the pipeline agent, followed immediately by a security scan hook, can trigger the rule as if new infected files were being introduced to the production environment.
  • Filter/Exclusion: Create an exclusion for directories starting with /tmp/build-*, /var/jenkins_home/workspace/*, and /home/ci-runner/*. Filter events where the parent process name contains jenkins-agent, gitlab-runner, or argocd-server and the user is a non-interactive service account (e.g., ci-bot).

• Configuration Management Agent Scans

  • Scenario: Infrastructure as Code tools such as