← Back to SOC feed Coverage →

Equation Group hack tool leaked by ShadowBrokers- file estesfox

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-07T23:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential exploitation of the leaked Equation Group tool ‘estesfox’ by adversaries attempting to execute malicious code within a network. SOC teams should proactively hunt for this behavior to identify and mitigate early-stage advanced persistent threat activity leveraging compromised tools.

YARA Rule

rule EquationGroup_estesfox {
   meta:
      description = "Equation Group hack tool leaked by ShadowBrokers- file estesfox"
      author = "Florian Roth"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-08"
      hash1 = "33530cae130ee9d9deeee60df9292c00242c0fe6f7b8eedef8ed09881b7e1d5a"
   strings:
      $x1 = "chown root:root x;chmod 4777 x`' /tmp/logwatch.$2/cron" fullword ascii
   condition:
      all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_eqgrp_apr17.yar