← Back to SOC feed Coverage →

Generic detection for ELF Linux process injector mandibule generic

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-18T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversaries executing ELF binary injection on Linux systems to establish persistence or evade detection by manipulating legitimate processes. Proactively hunting for this behavior in Azure Sentinel is critical because it identifies subtle, low-severity injection activities that may indicate early-stage lateral movement or credential theft before they escalate into high-impact incidents.

YARA Rule

rule TOOLKIT_Mandibule {
	meta:
		description = "Generic detection for ELF Linux process injector mandibule generic"
		reference = "https://imgur.com/a/MuHSZtC"
		author = "unixfreaxjp"
		org = "MalwareMustDie"
		date = "2018-06-01"
	condition:
		((is__str_mandibule_gen1) or (is__hex_mid_mandibule32))
		or ((is__str_mandibule_gen1) or (is__hex_top_mandibule64))
		and is__elf
		and filesize < 30KB 
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

References

False Positive Guidance

Here are 5 specific false positive scenarios for the Generic detection for ELF Linux process injector rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/TOOLKIT_Mandibule.yar