The detection identifies potential Equation Group malware activity through the presence of a suspicious string, which is a hallmark of advanced persistent threat actors. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover stealthy, long-term compromise attempts that may evade traditional detection methods.
YARA Rule
rule Equation_Kaspersky_SuspiciousString
{
meta:
description = "Equation Group Malware - suspicious string found in sample"
author = "Florian Roth"
reference = "http://goo.gl/ivt8EW"
date = "2015/02/17"
score = 60
strings:
$mz = { 4d 5a }
$s1 = "i386\\DesertWinterDriver.pdb" fullword
$s2 = "Performing UR-specific post-install..."
$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
$s4 = "STRAITSHOOTER30.exe"
$s5 = "standalonegrok_2.1.1.1"
$s6 = "c:\\users\\rmgree5\\"
condition:
( $mz at 0 ) and filesize < 500000 and all of ($s*)
}
This YARA rule can be deployed in the following contexts:
This rule contains 7 string patterns in its detection logic.
Scenario: A system administrator is using PowerShell to automate log file parsing and inadvertently includes a string matching the Equation Group signature.
Filter/Exclusion: Exclude processes initiated by the PowerShell executable with a command line containing log-parser.ps1 or similar automation scripts.
Scenario: A scheduled backup job using Veeam Backup & Replication generates temporary files that contain the suspicious string due to a misconfigured template or script.
Filter/Exclusion: Exclude processes associated with veeam.exe or any process with a command line containing backup-job-name or backup-schedule.
Scenario: A Windows Task Scheduler job runs a legitimate PowerShell script for system monitoring that includes a string matching the Equation Group signature.
Filter/Exclusion: Exclude processes launched by the Task Scheduler (schtasks.exe) or any process with a command line containing monitoring-script.ps1.
Scenario: A system update or patching tool like Chocolatey or WSUS includes a temporary file or log entry that contains the suspicious string.
Filter/Exclusion: Exclude processes related to choco.exe, wsusutil.exe, or any process with a command line containing update or patch.
Scenario: A network monitoring tool such as Wireshark or tcpdump captures a legitimate network packet that contains a string matching the Equation Group signature.
Filter/Exclusion: Exclude processes related to wireshark.exe, tcpdump.exe, or any process with a command line containing capture or sniff.