MALW TinyShell backconnect ELF

Hunt Hypothesis

This hunt targets adversaries deploying the TinyShell ELF malware to establish covert outbound connections from Linux workloads within the Azure Sentinel environment. Proactively hunting for this behavior is critical because, despite its low severity classification, early detection of these backconnect sessions can prevent lateral movement and data exfiltration before the malware escalates to a higher threat level.

YARA Rule

rule MALW_TinyShell_backconnect_ELF {
 meta:
    date = "2018-02-10"
    author = "@unixfreaxjp"
 condition:
    is__elf
    and priv01
    and ((priv02)
      or ((priv03)
        or (priv04)))
    and filesize < 100KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the MALW TinyShell backconnect ELF detection rule in an enterprise environment, along with recommended filtering strategies:

• Scenario: Software Deployment via SCCM/Intune (Tiny Shell Wrapper)

  • Context: Enterprise deployment tools like Microsoft Endpoint Configuration Manager (SCCM) or Intune often utilize a lightweight shell wrapper (tinyshell.exe or similar ELF binaries on Linux endpoints) to execute installation scripts. These wrappers frequently establish outbound connections to the management server to report status or download payloads, mimicking the “backconnect” behavior of the malware.
  • Filter/Exclusion: Exclude processes where the parent process is ccmexec.exe (SCCM) or IntuneManagementExtension.exe, and the binary path resides within the standard deployment directories (e.g., C:\Windows\CCM\ or /opt/microsoft/intune-management-extension/).

• Scenario: Scheduled System Health Checks using curl or wget

  • Context: IT Operations teams often schedule cron jobs (Linux) or Task Scheduler tasks (Windows) that use standard utilities like curl, wget, or custom ELF scripts to ping internal monitoring endpoints (e.g., Datadog, Splunk HEC, or internal load balancers). If these tools are compiled with a minimal runtime environment resembling “TinyShell,” they will trigger the rule when initiating HTTPS connections.
  • Filter/Exclusion: Create an exclusion for binaries located in standard system paths (/usr/bin/curl, /usr/bin/wget) and restrict alerts to only those connecting to non-standard ports or external IP ranges outside of the organization’s known monitoring CIDR blocks.

• Scenario: CI/CD Pipeline Agents (Jenkins/GitLab Runners)

  • Context: Build agents running on containerized environments often utilize a minimal ELF