moose

Hunt Hypothesis

The moose rule detects potential adversarial activity involving suspicious file behavior that may indicate a low-severity threat. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage threats that could escalate into more severe incidents.

YARA Rule

rule moose
{
    meta:
        Author      = "Thomas Dupuy"
        Date        = "2015/04/21"
        Description = "Linux/Moose malware"
        Reference   = "http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf"
        Source = "https://github.com/eset/malware-ioc/"
        Contact = "[email protected]"
        License = "BSD 2-Clause"

    strings:
        $s0 = "Status: OK"
        $s1 = "--scrypt"
        $s2 = "stratum+tcp://"
        $s3 = "cmd.so"
        $s4 = "/Challenge"
        $s7 = "processor"
        $s9 = "cpu model"
        $s21 = "password is wrong"
        $s22 = "password:"
        $s23 = "uthentication failed"
        $s24 = "sh"
        $s25 = "ps"
        $s26 = "echo -n -e "
        $s27 = "chmod"
        $s28 = "elan2"
        $s29 = "elan3"
        $s30 = "chmod: not found"
        $s31 = "cat /proc/cpuinfo"
        $s32 = "/proc/%s/cmdline"
        $s33 = "kill %s"

    condition:
        is_elf and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 20 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: System update or patch deployment using WSUS (Windows Server Update Services)
  Filter/Exclusion: Check for EventID=19014 or EventID=19015 related to Windows Update, or filter by ProcessName="wusa.exe" with known update hashes.

• Scenario: Scheduled backup job using Veeam Backup & Replication
  Filter/Exclusion: Filter by ProcessName="vmbackup.exe" or check for known Veeam backup process hashes in the YARA rule.

• Scenario: Admin task to configure Group Policy Objects (GPO) via gpupdate
  Filter/Exclusion: Filter for ProcessName="gpupdate.exe" or check for EventID=1000 related to GPO processing.

• Scenario: Log collection or monitoring tool like Splunk or ELK Stack running scheduled data ingestion
  Filter/Exclusion: Filter by ProcessName="splunkd.exe" or ProcessName="logstash" with known tool-specific hashes.

• Scenario: Automated security scan using Nessus or OpenVAS
  Filter/Exclusion: Filter for ProcessName="nessuscli.exe" or ProcessName="openvas", or check for known scan tool hashes in the YARA rule.