Detects PeerBlight Linux backdoor with systemd persistence artifacts and user-mode masquerading strings, linked to React

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the PeerBlight Linux backdoor who establish long-term access via systemd services while masking their presence through user-mode string manipulation following a React2Shell exploitation. Proactive hunting for these specific persistence and masquerading artifacts in Azure Sentinel is critical to identify stealthy post-exploitation activities that may evade standard signature-based detections, ensuring early containment of this high-severity threat.

YARA Rule

rule MAL_PeerBlight_Dec25 {
   meta:
      description = "Detects PeerBlight Linux backdoor with systemd persistence artifacts and user-mode masquerading strings, linked to React2Shell exploitation"
      author = "RussianPanda"
      date = "2025-12-07"
      score = 85
      reference = "https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell"
      hash = "a605a70d031577c83c093803d11ec7c1e29d2ad530f8e95d9a729c3818c7050d"
      id = "23e6d040-00cb-5ad4-9f9b-bdbabeabd7ab"
   strings:
      $s1 = "/bin/systemd-daemon"
      $s2 = "/lib/systemd/system/systemd-agent.service"
      $s3 = "group"
      $s4 = "tag"
      $s5 = "arch"
      $s6 = "softirq"
   condition:
      uint32(0) == 0x464c457f and 5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PeerBlight Linux backdoor detection rule, tailored for an enterprise environment:

• Automated CI/CD Pipeline Deployment with Systemd Templates

  • Scenario: DevOps teams use tools like Jenkins or GitLab Runner to deploy microservices. The deployment scripts often generate new systemd unit files dynamically (e.g., /etc/systemd/system/app-service.service) containing generic description strings that mimic the “user-mode masquerading” patterns of PeerBlight. These scripts frequently invoke react-related build tools or shell wrappers during the installation phase, triggering the rule’s React2Shell linkage logic.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is a known CI/CD agent (e.g., jenkins-agent, gitlab-runner) and the executed command contains specific deployment flags like --install or --deploy. Additionally, whitelist any systemd unit files created within the /opt/ci-deployments directory path.

• Scheduled Security Compliance Scans (CIS Benchmarking)

  • Scenario: Enterprise security tools such as Tenable Nessus, Qualys, or OpenSCAP run nightly scheduled jobs to audit system configurations. These agents often execute shell scripts that parse systemd unit files and inject specific masquerading strings into logs to verify service integrity. The scanning process frequently utilizes a custom wrapper script named react-check.sh (or similar) which aligns with the rule’s “React” keyword, causing the detection logic to misinterpret the audit activity as backdoor persistence.
  • Suggested Filter/Exclusion: Create an exclusion for processes running under the root user during the defined maintenance window (e.g., 02:00–04:00 UTC)