This hunt targets adversaries executing ELF binary injection on Linux systems to establish persistence or evade detection by manipulating legitimate processes. Proactively hunting for this behavior in Azure Sentinel is critical because it identifies subtle, low-severity injection activities that may indicate early-stage lateral movement or credential theft before they escalate into high-impact incidents.
rule TOOLKIT_Mandibule {
meta:
description = "Generic detection for ELF Linux process injector mandibule generic"
reference = "https://imgur.com/a/MuHSZtC"
author = "unixfreaxjp"
org = "MalwareMustDie"
date = "2018-06-01"
condition:
((is__str_mandibule_gen1) or (is__hex_mid_mandibule32))
or ((is__str_mandibule_gen1) or (is__hex_top_mandibule64))
and is__elf
and filesize < 30KB
}
This YARA rule can be deployed in the following contexts:
Here are 5 specific false positive scenarios for the Generic detection for ELF Linux process injector rule in an enterprise environment, along with suggested filters or exclusions:
Scenario: Automated Software Updates via Package Managers
yum, apt, or dnf to update critical infrastructure components. These package managers often extract new binaries and inject configuration data into running services (e.g., restarting nginx or postgres) using standard ELF injection mechanisms that mimic the behavior of malicious loaders.ppid) is a known package manager binary (e.g., /usr/bin/apt, /usr/bin/yum, /usr/lib/systemd/systemd running update scripts) and the executed path resides within standard OS directories like /var/cache/apt/archives or /var/spool/yum.Scenario: Container Orchestration Runtime Initialization
containerd, cri-o, or docker) constantly spawn new containers. This involves injecting the entrypoint ELF binary into a new namespace and attaching it to the host’s process tree, which frequently triggers generic injection alerts due to the rapid creation of child processes with distinct memory mappings./usr/bin/containerd, /var/run/docker.pid associated processes) where the target process path contains standard container image prefixes such as /var/lib/docker/overlay2 or /run/kubelet/pods.Scenario: Enterprise Antivirus and EDR Scanning Agents