Linux hack tools - file mass

Hunt Hypothesis

This rule detects adversaries leveraging Linux-based hacking utilities to perform mass file operations, such as bulk creation or deletion, often indicative of data staging or anti-forensics activities. Proactive hunting for this behavior in Azure Sentinel is essential to identify early-stage lateral movement or evidence tampering that may precede more critical security incidents despite the rule’s low severity classification.

YARA Rule

rule LinuxHacktool_eyes_mass {
	meta:
		description = "Linux hack tools - file mass"
		author = "Florian Roth"
		reference = "not set"
		date = "2015/01/19"
		hash = "2054cb427daaca9e267b252307dad03830475f15"
	strings:
		$s0 = "cat trueusers.txt | mail -s \"eyes\" [email protected]" fullword ascii
		$s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
		$s3 = "killall -9 pscan2" fullword ascii
		$s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
		$s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii
	condition:
		1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• not set
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Linux hack tools - file mass” detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Backup Jobs Using rsync or tar

  • Context: Automated nightly backup scripts (e.g., running via Cron) often utilize tools like rsync, tar, or dump to process thousands of files simultaneously across directories. This mass file creation, modification, and deletion mimics the behavior of a hacker staging data for exfiltration or hiding artifacts.
  • Filter/Exclusion: Exclude processes where the executable path matches known backup tools (e.g., /usr/bin/rsync, /bin/tar) AND the user context is root or a dedicated service account like backup_svc. Additionally, filter by time window to exclude runs occurring during standard maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: Continuous Integration servers (such as Jenkins, GitLab Runner, or GitHub Actions agents) frequently execute build steps that involve mass file operations. For instance, a Docker image build might extract layers and generate hundreds of temporary files in /tmp or the project workspace before packaging them.
  • Filter/Exclusion: Create an exclusion for processes spawned by CI/CD orchestrators (e.g., jenkins, gitlab-runner) executing within specific containerized environments or designated build directories (e.g., paths starting with /var/jenkins_home or /opt/ci-builds).

• Scenario: Log Rotation and Archiving via logrotate

  • Context: The system utility logrotate periodically processes large volumes of log files, compressing them (creating .gz files) and deleting old archives. This results in a