MALW TinyShell backdoor Gen

Hunt Hypothesis

This hunt targets adversaries deploying the TinyShell backdoor to establish persistent command-and-control channels via lightweight shell execution on Azure endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because its low-severity classification may cause it to be overlooked by automated alerts, allowing attackers to maintain stealthy footholds before escalating their activities.

YARA Rule

rule MALW_TinyShell_backdoor_Gen {
 meta:
    date = "2018-02-11"
    author = "@unixfreaxjp"
 condition:
    ((is__elf) or  (is__osx))
    and priv01
    and filesize > 20KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the MALW TinyShell backdoor Gen detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Software Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents frequently execute PowerShell scripts to deploy software updates. These scripts often spawn powershell.exe processes that download and execute small, temporary shell scripts from trusted internal repositories, mimicking the behavior of a TinyShell backdoor establishing persistence.
  • Filter/Exclusion: Create an exclusion for the specific parent process paths used by deployment agents (e.g., C:\Windows\CCM\PolicyAgent.exe or C:\Program Files (x86)\Microsoft Intune Management Extension\IntuneManagementExtension.exe) spawning child processes that match the YARA signature. Additionally, filter on the hash of known-good deployment scripts stored in a central artifact store.

• Scenario: Scheduled Health Check and Log Rotation Jobs

  • Context: Enterprise IT operations rely heavily on Windows Task Scheduler to run maintenance tasks. A common task involves schtasks.exe or TaskSchedulerService launching lightweight shell scripts (.ps1 or .bat) to rotate logs, check disk space, or query service health. These short-lived, script-based executions often trigger the “backdoor” logic due to their self-contained nature and network connectivity requirements.
  • Filter/Exclusion: Exclude events where the parent process is TaskSchedulerService (or svchost.exe with the specific service name) and the command line arguments contain references to standard maintenance directories (e.g., \Windows\System32\Tasks\). Implement a time-based filter to suppress alerts for these known tasks during their scheduled execution windows.

• **Scenario: Endpoint Detection and Response (EDR) Self