← Back to SOC feed Coverage →

EQGRP Toolset Firewall - RC5 / RC6 opcode

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-23T11:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential use of the EQGRP Toolset Firewall module with RC5 or RC6 opcodes, which may indicate adversarial network communication or data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early-stage compromise or lateral movement by advanced persistent threats.

YARA Rule

rule EQGRP_RC5_RC6_Opcode
{

    meta:
        description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
        author = "Florian Roth"
        reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
        date = "2016-08-17"

    strings:
        /*
            mov     esi, [ecx+edx*4-4]
            sub     esi, 61C88647h
            mov     [ecx+edx*4], esi
            inc     edx
            cmp     edx, 2Bh
        */
        $s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }
    
    condition:
        1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_EQUATIONGRP.yar