This generic rule will find ELF files containing a ptrace string. ptrace can be abused to inject code and for various anti-analysis techniques on *nix hosts.

Here are some links pertaining to ptrace abuse: https://pinboard.in/u:droberson/t:ptrace/

rule ptrace
{
	meta:
		description = "ELF files possibly abusing ptrace"

	strings:
		$ = "ptrace"

	condition:
		uint32(0) == 0x464c457f and all of them
}

YARA Rules Index