100 Days of YARA – Day 42: ptrace

This generic rule will find ELF files containing a ptrace string. ptrace can be abused to inject code and for various anti-analysis techniques on *nix hosts.

Here are some links pertaining to ptrace abuse: https://pinboard.in/u:droberson/t:ptrace/

rule ptrace
{
	meta:
		description = "ELF files possibly abusing ptrace"

	strings:
		$ = "ptrace"

	condition:
		uint32(0) == 0x464c457f and all of them
}

YARA Rules Index

One thought on “100 Days of YARA – Day 42: ptrace

  1. Pingback: Week 05 – 2022 – This Week In 4n6

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s