Detects Plague backdoor ELF binaries, related to PAM authentication alteration.

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying Plague backdoor ELF binaries that manipulate PAM authentication modules to establish persistent access and evade standard login controls. A proactive search within Azure Sentinel is essential because these stealthy modifications often bypass traditional signature-based detection, allowing attackers to silently intercept credentials or escalate privileges before triggering broader alerts.

YARA Rule

rule MAL_LNX_PLAGUE_BACKDOOR_Jul25 {
   meta:
      description = "Detects Plague backdoor ELF binaries, related to PAM authentication alteration."
      reference = "Internal Research"
      author = "Pezier Pierre-Henri"
      date = "2025-07-25"
      score = 80
      hash = "14b0c90a2eff6b94b9c5160875fcf29aff15dcfdfd3402d953441d9b0dca8b39"
      hash = "7c3ada3f63a32f4727c62067d13e40bcb9aa9cbec8fb7e99a319931fc5a9332e"
      id = "2c2e9030-fcef-58c9-9ed2-798560b8b384"
   strings:
      $s1 = "decrypt_phrase"
      $s2 = "init_phrases"

      $x1 = "captured_password"
      $x2 = "updateklog"
      $x3 = "init_cred_structs"

      $xop1 = {
         48 8b [4] 00    // mov     rax, cs:_ent_ptr
         8b 00           // mov     eax, [rax]
         3d ca b2 e9 f1  // cmp     eax, 0F1E9B2CAh
         74              // jz      short loc_4586
      }
   condition:
      uint32be(0) == 0x7f454c46
      and filesize < 1MB
      and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects Plague backdoor ELF binaries, related to PAM authentication alteration” rule, including suggested filters and exclusions:

• Scenario: Scheduled System Updates via yum or apt

  • Context: During routine maintenance windows, package managers (e.g., yum, dnf, apt) install security patches that often involve updating core PAM libraries (libpam.so, libnss_pam.so). These updates trigger the installation of new ELF binaries into /usr/lib64/security or /etc/pam.d/.
  • Suggested Filter: Exclude events where the parent process is a known package manager (e.g., yum, dnf, apt-get) and the file path matches standard library directories (/usr/lib*/security/*).

• Scenario: Automated Configuration Management via Ansible or Puppet

  • Context: Infrastructure automation tools like Ansible, Puppet, or Chef frequently deploy configuration changes that modify PAM stack files (e.g., /etc/pam.d/password, /etc/pam.d/login) to enforce new password policies. These agents often copy or replace ELF binaries as part of the deployment workflow.
  • Suggested Filter: Create an exclusion for processes running under specific service accounts used by automation tools (e.g., root user executing via ansible-runner, puppet-agent, or chef-client) where the action is a file modification in /etc/pam.d/.

• Scenario: Deployment of Custom Authentication Modules

  • Context: DevOps teams may deploy custom authentication modules (e.g., integrating with Okta, Auth0, or internal LDAP) by copying new .so (Shared Object) ELF binaries into the PAM security directory. This is a legitimate administrative task to extend identity management capabilities