Detects ELF Linux/Torte infection

Hunt Hypothesis

This hypothesis posits that adversaries are actively deploying ELF-based Linux malware to establish persistent footholds within containerized or server workloads, often evading initial signature-based defenses due to its low-severity classification. Proactive hunting in Azure Sentinel is critical to uncover these stealthy infections early, ensuring that subtle behavioral anomalies indicative of Torte variants are identified before they escalate into broader lateral movement threats.

YARA Rule

rule ELF_Linux_Torte_domains {
	meta:
		author = "@mmorenog,@yararules"
		description = "Detects ELF Linux/Torte infection"
		ref1 = "http://blog.malwaremustdie.org/2016/01/mmd-0050-2016-incident-report-elf.html"
	strings:
		$1 = "pages.touchpadz.com" ascii wide nocase
		$2 = "bat.touchpadz.com" ascii wide nocase
		$3 = "stat.touchpadz.com" ascii wide nocase
		$4 = "sk2.touchpadz.com" ascii wide nocase

	condition:
		any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ELF Linux/Torte detection rule in an enterprise environment, along with recommended filters or exclusions:

• CI/CD Pipeline Artifact Generation

  • Scenario: Automated build agents (e.g., Jenkins, GitLab CI, or GitHub Actions) frequently compile source code into new ELF binaries within the /tmp or /workspace directories. The Torte infection logic may misinterpret the rapid creation of legitimate, unsigned executables by compilers like gcc or clang as a potential infection event, especially if the build process involves dynamic linking or temporary script execution.
  • Filter/Exclusion: Exclude file paths matching known CI/CD workspace directories (e.g., /var/lib/jenkins/workspace/*, /home/gitlab-runner/builds/*) and filter out events where the parent process is a recognized build tool (java running Jenkins, gitlab-runner, or docker).

• Software Repository Updates via Package Managers

  • Scenario: Scheduled maintenance windows trigger mass updates using package managers like YUM, DNF, or APT. During these tasks, the system downloads and installs new ELF binaries (e.g., security patches for kernel, nginx, or python). The detection engine might flag the installation of these legitimate, signed packages as “infection” because they involve writing new executable files to critical directories like /usr/bin or /opt.
  • Filter/Exclusion: Create an exclusion rule based on the parent process name (dnf, yum, apt-get) and correlate with events where the file signature hash matches a known trusted repository (e.g., GPG signed packages). Additionally, exclude files located in standard package manager cache directories (e.g., /var/cache/dnf/*).

• Enterprise Endpoint Management Deployments *