Detects Tiny Shell variant for SPARC - an open-source UNIX backdoor

Hunt Hypothesis

This detection identifies the presence of a Tiny Shell variant backdoor on SPARC-based UNIX systems, signaling potential adversary persistence through an open-source shell replacement designed to evade standard monitoring. SOC teams should proactively hunt for this behavior in Azure Sentinel because SPARC architectures often host critical legacy infrastructure where undetected backdoors can facilitate long-term data exfiltration and command execution without triggering conventional alerting mechanisms.

YARA Rule

rule EXT_HKTL_MAL_TinyShell_Backdoor_SPARC {
   meta:
      author = "Mandiant"
      description = "Detects Tiny Shell variant for SPARC - an open-source UNIX backdoor"
      date = "2022-03-17"
      reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
      score = 80
      id = "0a05a316-65b7-5cdf-849b-820ab60afbbd"
   strings:
      $sb_xor_1 = { DA 0A 80 0C 82 18 40 0D C2 2A 00 0B 96 02 E0 01 98 03 20 01 82 1B 20 04 80 A0 00 01 82 60 20 00 98 0B 00 01 C2 4A 00 0B 80 A0 60 00 32 BF FF F5 C2 0A 00 0B 81 C3 E0 08 }
      $sb_xor_2 = { C6 4A 00 00 80 A0 E0 00 02 40 00 0B C8 0A 00 00 85 38 60 00 C4 09 40 02 84 18 80 04 C4 2A 00 00 82 00 60 01 80 A0 60 04 83 64 60 00 10 6F FF F5 90 02 20 01 81 C3 E0 08 }
   condition:
      uint32(0) == 0x464C457F and (uint16(0x10) & 0x0200 == 0x0200) and (uint16(0x12) & 0x0200 == 0x0200) and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://www.mandiant.com/resources/blog/unc2891-overview
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Tiny Shell variant for SPARC detection rule, including suggested filters and exclusions:

• Scenario: Legacy Solaris System Administration via tsh Wrapper Scripts

  • Context: In an enterprise running legacy Oracle Solaris on SPARC hardware, administrators often use custom wrapper scripts (e.g., /opt/admin/bin/maintenance.sh) that invoke a lightweight shell binary named tsh or similar variants to execute routine patching commands. The detection logic may misinterpret the execution of this specific binary as the malicious Tiny Shell backdoor.
  • Filter/Exclusion: Create an exclusion rule based on the full file path and hash. Exclude any process where Process.Path matches /opt/admin/bin/tsh* AND File.HASH_SHA256 equals [Known_Good_Hash]. Additionally, exclude processes spawned by known admin accounts (e.g., user=oracle_admin, user=solaris_root).

• Scenario: Scheduled Database Backup Jobs Using Embedded Shell

  • Context: Automated backup solutions like Oracle RMAN or custom cron jobs often embed a minimal shell environment to handle log rotation and temporary file processing. These jobs frequently spawn the Tiny Shell variant as a child process of the main database service (e.g., oracle or postgres) rather than running it directly from user input, triggering the rule due to the binary’s signature match.
  • Filter/Exclusion: Implement a parent-child relationship filter. Exclude alerts where Parent.Process.Name is in the list [rman, cron, systemd] AND Process.Path contains /var/opt/oracle/bin/tsh. Ensure the exclusion applies only when the process duration is under 5 minutes and no network connections are initiated by the child shell.

• **Scenario: CI/CD Pipeline Execution on SPARC Build Nodes