Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
8
3
Contributors
6
3
2
Categories
5
4
2
2
1
Platforms
7
2
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects communication to known Command and Control (C2) servers associated with the Equation Group, as identified in the operational notes from the ShadowBrokers leak. This rule specifically looks for network connections to or from the hardcoded IP addresses linked to Equation Group C2 infrastructure.
C2-NamedPipe
KQL
Detects the creation of a named pipe used by known APT malware.
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Detects a specific export function name used by one of EquationGroup tools
Detects a specific export function name used by one of EquationGroup tools
This query helps in reviewing top policies for user overrides (Allow/Block)
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_equationgroup_c2.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects the creation of named pipes that have been observed in use by known APT groups or malware. This rule specifically looks for a predefined list of pipe names associated with various malicious activities, including those used by Project Sauron, SolarWinds SUNBURST, LiquidSnake, Turla HyperStack, Sofacy group malware, Hidden Cobra Hoplight, Pacifier, Snatch Ransomware, Covenant, Qbot, Uroburos Malware, PoshC2, Wild Neutron, Cloud Hopper (RedLeaves), Equation Group malware, Cobra Trojan, Crackmapexec, and Emissary Panda (Hyperbro).
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' campaign, which targeted iOS devices with 0-day exploits. This rule specifically looks for connections to a list of known malicious domains via proxy logs.
Detects the execution of a process with command-line arguments containing '-export dll_u' or ending with ',dll_u' or ' dll_u'. This specific export function name 'dll_u' is known to be used by tools associated with the Equation Group, indicating potential malicious activity related to their implants or frameworks.
This rule detects suspicious execution of rundll32.exe when its parent process is control.exe, specifically excluding cases where 'Shell32.dll' is present in the command line. This behavior has been observed in attacks by the Equation Group and exploit kits to load malicious DLLs via the Control Panel process, often as a defense evasion technique.
Detects suspicious shell commands used in various Equation Group scripts and tools