ELFieScanner: Advanced process memory threat detection on Linux
ELFieScanner
A C++ POC for advanced process memory scanning that attempts to detect many malicious techniques used by threat actors & those that have been incorporated into open-source user-mode rootkits.
ELFieScanner inspects every running process (both x86/x64) and its corresponding loaded libraries to look for evil. It then outputs the resultant telemetry into a NDJSON file. ELFieScanner offers four main scanner capabilities to look for:
- Shared Object injection techniques.
- Entry point manipulation techniques.
- Shellcode injection & Process hollowing.
- API hooking.
Each technique ELFieScanner looks for is displayed within config.json. This config file provides the user with the ability to switch on/off each heuristic and also modify the fuzzy hash thresholds required to generate any output files.
ELFieScanner will produce three output files, one for each scan type in the format hostname_scannerType_output_arch.json. Events will only be generated for processes that have fired on one or more of the heuristics.
Kibana mappings have also been provided for the output files should one wish to index the data to make threat hunting analysis easier. These can be found in the elk_mappings folder.
Configuration & Heuristics
Each heuristic is prepended with the initials of which scanner type it belongs to:
esEntrypoint scanner.lsLibrary scanner.ssShellcode scanner.
To turn on a heuristic set the value to true. To turn off a heuristic set the value to false.
| Heuristic | Description |
|---|---|
| es_section_hdr_missing | Section headers can been stripped from a binary (this is suspicious but not necessarily malicious). Stripping the section headers makes reverse engineering of the binary more difficult. However it could be done make the binary smaller. The e_shoff This member holds the section header table’s file offset in bytes. If the file has no section header table, this member holds zero. |
| es_phdr_wrong_location | Check to see if if the program headers start in the expected place (immediately after the ELF32_Ehdr/ELF64_Ehdr) e.g. 64 bytes offset for 64-bit, or 52 bytes offset for 32-bit. |
| es_proc_missing_disk_backing | Check the process is not backed by disk executable. More of an anomaly rather than a detection. |
| es_proc_text_segment_missing_disk | Check to see if the .text segment is present on disk. This should always be present unless the binary is still packed/obfuscated in memory. |
| es_proc_text_segment_missing_mem | Is the .text segment is present in memory. This should always be present unless the disk backed binary is packed/obfuscated. |
| es_proc_entry_points_not_in_text | Check to see if the e_entry field does NOT point within the .text segment. This should always be the case apart from special cases such as ‘VBoxService’. |
| es_proc_entry_points_not_matching | Check to see if the e_entry values for process & disk binary match. |
| es_proc_entry_fuzzy_score | Check the e_entry for the libc linked process matches the expected initialization code for ‘libc_start_main’. Highly suspicious unless this is for an interpreter process e.g. ‘/usr/bin/python’ OR container processes ‘/usr/sbin/VBoxService’. If the real score is below es_proc_entry_fuzzy_score then result will be generated. Set fuzzy score threshold (0-100) |
| es_proc_init_fini_not_in_text | If either: 1. A process init/fini sections that don’t appear in .text segment 2. A process preinit/init/fini array functions that don’t point within the .text segment. |
| es_proc_init_not_at_text_start | For processes it is expected the .init code block should begin at the start of the .text segment. NOTE: this is not expected for modules. |
| es_mod_missing_disk_backing | Check to see if module is backed by disk executable. More of an anomaly rather than a detection. Check against every module. |
| es_mod_entry_points_not_in_text | Check the e_entry field points within .text segment of the module. This should always be the case for modules. Check against every module. |
| es_mod_entry_points_not_matching | Check to see the e_entry values for module and disk match. Check against every module. |
| es_mod_init_fini_not_in_text | Checks every module for : 1. module init/fini sections that don’t appear in .text segment 2. module preinit/init/fini array functions that don’t point within the .text segment. |
| ls_elf_in_anonymous_mapping | An ELF header found in an anonymous memory mapping. |
| ls_executable_anonymous_mapping | Executable anonymous memory mapping present. |
| ls_phdr_wrong_location | Program headers in wrong location. |
| ls_mod_missing_disk_backing | A module doesn’t have disk backing. Checks for every module. |
| ls_module_not_in_procmaps | A module doesn’t exist in /proc/pid/maps. Checks for every module. |
| ls_module_not_in_linkmap | A module doesn’t exist in link_map structure. Checks for every module. |
| ls__libc_dlopen_mode_in_got | A Global Offset table (GOT) address points __libc_dlopen_mode func. |
| ls__libc_dlopen_mode_in_rodata | __libc_dlopen_mode string in rodata section. |
| ls_dtnull_missing | DT_NULL missing from dynamic section. |
| ls_dtdebug_missing | DT_DEBUG missing from dynamic section. |
| ls_dtneeded_incorrect_order | DT_NEEDED in non-sequential (incorrect) order in dynamic section. |
| ls_dynstr_manipulated | Dynamic string table manually manipulated. |
| ls_ldpreload_set | LD_PRELOAD populated. |
| ls_ldpreload_hooking | LD_PRELOAD hooking present. |
| ls_ldconfig_set | LD_CONFIG populated. |
| ls_ldpath_set | LD_PATH manipulated. |
| ls_dynamic_segment_missing | Dynamic segment missing. |
| ss_proc_missing_disk_backing | Process missing disk backed binary. |
| ss_proc_phdr_memory_disk_mismatch | The number of process program headers in memory should equal that of its corresponding disk binary. Any mismatch indicates a segment has either been added or taken away in memory. |
| ss_rwx_present_disk | Process memory contains a segment with Read/write & execute permissions. |
| ss_rwx_present_mem | Process binary contains a segment with Read/write & execute permissions. |
| ss_dynamic_segment_missing | Dynamic segment missing. Can indicate packing. |
| ss_memfd_mapping_found | Process loaded directly from memory using memfd_create() |
| ss_mod_missing_disk_backing | module missing disk backed binary. Check for all modules |
| ss_mod_phdr_memory_disk_mismatch | The number of module program headers in memory should equal that of its corresponding disk binary. Any mismatch indicates a segment has either been added or taken away in memory. Check for all modules. |
| ss_mod_rwx_header_present_disk | Module binary contains a segment with Read/write & execute permissions. Check for all modules. |
| ss_mod_rwx_header_present_mem | Module memory contains a segment with Read/write & execute permissions. Checks against all modules. |
| ss_proc_score | This measures the similarity between process disk & memory text (RX) segments. A low score indicates significant changes (and thus possible injection of code). If the real score is below ss_proc_score then result will be generated. Set fuzzy score threshold (0-100) |
| ss_lowest_mod_score | This measures the similarity between module disk & memory text (RX) segments. A low score indicates significant changes (and thus possible injection of code). If the real score is below ss_lowest_mod_score then result will be generated. Set fuzzy score threshold (0-100) |
Install & Use
Copyright (c) 2023 Daniel Jary
