Equation Group hack tool leaked by ShadowBrokers- file dumppoppy

Hunt Hypothesis

The detection identifies potential exploitation of a leaked Equation Group hack tool, specifically the dumppoppy file, which may indicate adversary use of advanced persistent threat techniques. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromise from sophisticated, state-sponsored actors.

YARA Rule

rule EquationGroup_dumppoppy {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file dumppoppy"
      author = "Florian Roth"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "4a5c01590063c78d03c092570b3206fde211daaa885caac2ab0d42051d4fc719"
   strings:
      $x1 = "Unless the -c (clobber) option is used, if two RETR commands of the" fullword ascii
      $x2 = "mywarn(\"End of $destfile determined by \\\"^Connection closed by foreign host\\\"\")" fullword ascii

      $l1 = "End of $destfile determined by \"^Connection closed by foreign host"
   condition:
      ( filesize < 20KB and 1 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1
• Source Rule

False Positive Guidance

• Scenario: Legitimate System File Dump via Debugging Tools
  Description: A system administrator uses a legitimate tool like Process Explorer or ProcDump to dump memory from a process for debugging or troubleshooting purposes.
  Filter/Exclusion: Exclude processes associated with known debugging tools or check for the presence of procmon.exe, procexp.exe, or ProcDump.exe in the process tree.

• Scenario: Scheduled Job for Log File Analysis
  Description: A scheduled task runs a script using PowerShell or Python to analyze log files and dump memory from a service for forensic analysis.
  Filter/Exclusion: Filter out processes initiated by scheduled tasks (e.g., schtasks.exe or Task Scheduler) or check for known log analysis tools in the command line.

• Scenario: Malware Analysis in a Sandbox Environment
  Description: A security analyst is running a sandboxed environment to analyze a suspected malicious file, and the tool dumppoppy is used to dump memory from a virtual process.
  Filter/Exclusion: Exclude processes running in a sandboxed environment (e.g., vmtoolsd.exe, VirtualBox, or WSL) or check for sandbox-specific indicators in the process context.

• Scenario: System Crash Dump Collection
  Description: The system automatically generates a crash dump (e.g., minidump) when a critical service crashes, and the dump is analyzed using tools like WinDbg.
  Filter/Exclusion: Exclude processes related to crash dump generation (e.g., crashdumper.exe, Windows Problem Reporting) or check for the presence of ntoskrnl.exe or smss.exe in the process tree.

• Scenario: Admin Task for Memory Profiling
  Description: An admin uses a