Linux hack tools - file screen

Hunt Hypothesis

This detection rule identifies adversaries deploying Linux-based hacking utilities that monitor or manipulate file system access to establish persistence and evade discovery. Proactive hunting for this behavior in Azure Sentinel is essential to uncover stealthy reconnaissance activities that may precede lateral movement or data exfiltration, despite the low severity classification of individual events.

YARA Rule

rule LinuxHacktool_eyes_screen {
	meta:
		description = "Linux hack tools - file screen"
		author = "Florian Roth"
		reference = "not set"
		date = "2015/01/19"
		hash = "a240a0118739e72ff89cefa2540bf0d7da8f8a6c"
	strings:
		$s0 = "or: %s -r [host.tty]" fullword ascii
		$s1 = "%s: process: character, ^x, or (octal) \\032 expected." fullword ascii
		$s2 = "Type \"screen [-d] -r [pid.]tty.host\" to resume one of them." fullword ascii
		$s6 = "%s: at [identifier][%%|*|#] command [args]" fullword ascii
		$s8 = "Slurped only %d characters (of %d) into buffer - try again" fullword ascii
		$s11 = "command from %s: %s %s" fullword ascii
		$s16 = "[ Passwords don't match - your armor crumbles away ]" fullword ascii
		$s19 = "[ Passwords don't match - checking turned off ]" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• not set
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Linux hack tools - file screen detection rule, including suggested filters or exclusions tailored to an enterprise environment:

• Automated Backup and Snapshot Operations

  • Scenario: Scheduled backup agents (e.g., rsync, tar, or cloud storage clients like AWS CLI) frequently scan directories to create snapshots. These tools often invoke file screening mechanisms that mimic the behavior of security scanners, triggering alerts when they access large numbers of files in /var/backups or /home.
  • Filter/Exclusion: Exclude processes running under specific service accounts (e.g., backup-agent, root with command line containing rsync or tar) and restrict the alert scope to exclude standard backup directories like /mnt/backup and /opt/backups.

• CI/CD Pipeline Artifact Generation

  • Scenario: Continuous Integration servers (e.g., Jenkins, GitLab Runner) executing build jobs often run file screening tools to validate artifact integrity before deployment. When a pipeline builds an application image or scans source code in /var/lib/jenkins/workspace, the mass file access triggers the rule as potential hack tool activity.
  • Filter/Exclusion: Create an exclusion for processes owned by CI service accounts (e.g., jenkins, gitlab-runner) and limit detection to non-build paths, excluding directories like /tmp/build-* or /var/lib/jenkins.

• Enterprise Antivirus and Endpoint Protection Scans

  • Scenario: Native Linux security agents (e.g., CrowdStrike Falcon, Sophos, or ClamAV) perform scheduled on-access scans. These agents utilize file screening logic to detect malware, which is indistinguishable from the “hack tools” behavior defined in this rule when they traverse user home directories during off-peak hours.
  • **Filter