Detects Tiny Shell - an open-source UNIX backdoor

Hunt Hypothesis

This detection rule identifies the deployment of Tiny Shell, a lightweight UNIX backdoor that adversaries use to establish persistent command-and-control channels while evading traditional signature-based defenses due to its minimal footprint. SOC teams should proactively hunt for this behavior in Azure Sentinel because early identification of such stealthy shell processes is critical to preventing lateral movement and data exfiltration before the adversary can fully embed within the environment.

YARA Rule

rule EXT_HKTL_MAL_TinyShell_Backdoor {
   meta:
      author = "Mandiant"
      description = "Detects Tiny Shell - an open-source UNIX backdoor"
      date = "2022-03-17"
      reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
      score = 80
      hash1 = "1f889871263bd6cdad8f3d4d5fc58b4a32669b944d3ed0860730374bb87d730a"
      id = "4ad5d334-98e4-577f-89c9-86626e8feb58"
   strings:
      $sb1 = { C6 00 48 C6 4? ?? 49 C6 4? ?? 49 C6 4? ?? 4C C6 4? ?? 53 C6 4? ?? 45 C6 4? ?? 54 C6 4? ?? 3D C6 4? ?? 46 C6 4? ?? 00 }
      $sb2 = { C6 00 54 C6 4? ?? 4D C6 4? ?? 45 C6 4? ?? 3D C6 4? ?? 52 }
      $ss1 = "fork" ascii fullword wide
      $ss2 = "socket" ascii fullword wide
      $ss3 = "bind" ascii fullword wide
      $ss4 = "listen" ascii fullword wide
      $ss5 = "accept" ascii fullword wide
      $ss6 = "alarm" ascii fullword wide
      $ss7 = "shutdown" ascii fullword wide
      $ss8 = "creat" ascii fullword wide
      $ss9 = "write" ascii fullword wide
      $ss10 = "open" ascii fullword wide
      $ss11 = "read" ascii fullword wide
      $ss12 = "execl" ascii fullword wide
      $ss13 = "gethostbyname" ascii fullword wide
      $ss14 = "connect" ascii fullword wide
   condition:
      uint32(0) == 0x464c457f and 1 of ($sb*) and 10 of ($ss*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

References

False Positive Guidance

False Positive Scenarios for “Detects Tiny Shell” Rule

Scenario: Automated CI/CD Pipeline Execution
- Context: DevOps pipelines often utilize lightweight shell containers to run build scripts or execute deployment commands. Tools like Jenkins, GitLab Runners, or GitHub Actions frequently spin up ephemeral containers running sh or bash to process artifacts, which can mimic the footprint of a backdoor shell.
- Suggested Filter: Exclude processes spawned by known CI/CD service accounts (e.g., jenkins, gitlab-runner) and restrict detection to non-containerized host environments. Additionally, filter out execution paths located within standard pipeline directories such as /var/lib/jenkins/workspace or /home/gitlab-runner.
Scenario: Scheduled Maintenance Scripts via Cron
- Context: System administrators rely heavily on cron jobs to perform routine maintenance tasks like log rotation (logrotate), database backups, or disk cleanup. These scripts often invoke a minimal shell interpreter (e.g., /bin/sh) with specific arguments that may lack the full context of an interactive session, triggering the “Tiny Shell” signature.
- Suggested Filter: Create an exclusion for processes where the parent process is cron and the command line matches known maintenance script paths (e.g., /usr/local/bin/maintenance.sh, /opt/scripts/backup_daily.sh). Include a filter to ignore executions occurring during defined maintenance windows (e.g., 02:00–04:00 local time).
Scenario: Configuration Management Tool Agent Activity
- Context: Enterprise configuration management tools like Ansible, Chef, or Puppet often execute remote commands on target nodes using a minimal shell environment to apply configurations. The agent daemon (e.g., ansible-runner or chef-client)