Equation Group hack tool set

Hunt Hypothesis

The Equation Group hack tool set is associated with advanced persistent threats and may indicate the presence of sophisticated malware or espionage activity. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential long-term compromise and unauthorized data exfiltration.

YARA Rule

rule EquationGroup_cursehappy_win2k_v_6_1_0 {
   meta:
      description = "Equation Group hack tool set"
      author = "Florian Roth"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-09"
      hash1 = "eb669afd246a7ac4de79724abcce5bda38117b3138908b90cac58936520ea632"
   strings:
      $op1 = { e8 24 2c 01 00 85 c0 89 c6 ba ff ff ff ff 74 d6 } /* Opcode */
      $op2 = { 89 4c 24 04 89 34 24 89 44 24 08 e8 ce 49 ff ff } /* Opcode */
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1
• Source Rule

False Positive Guidance

• Scenario: Legitimate System Maintenance Task
  Description: A system administrator is running a scheduled maintenance job that uses the eqg.exe tool as part of a routine system cleanup or patching process.
  Filter/Exclusion: Exclude processes where the executable path contains C:\Windows\System32\eqg.exe or where the process is initiated by a known system maintenance task (e.g., Task Scheduler with a known ID).

• Scenario: Software Update or Patch Deployment
  Description: A third-party security tool or enterprise patch management system is using the eqg.exe tool to deploy updates across the network.
  Filter/Exclusion: Exclude processes where the parent process is a known patch management tool (e.g., Microsoft Endpoint Configuration Manager, WSUS, or SCCM) or where the command line includes update-related arguments.

• Scenario: Forensic or Incident Response Activity
  Description: A security team is using the eqg.exe tool as part of an incident response or forensic analysis to investigate a potential breach.
  Filter/Exclusion: Exclude processes where the user is a member of the Security or Incident Response team, or where the process is initiated from a known forensic tool directory (e.g., C:\Tools\IncidentResponse).

• Scenario: Legacy System Compatibility Testing
  Description: A developer is testing compatibility of legacy applications that rely on the eqg.exe tool for legacy system interoperability.
  Filter/Exclusion: Exclude processes where the user is a developer with access to legacy systems, or where the process is initiated from a test environment (e.g., C:\TestEnvs\LegacyApp).

• Scenario: Scheduled Job for Log Analysis
  Description: A scheduled job is using the eqg.exe tool to analyze system