Equation Group hack tool set

Hunt Hypothesis

The Equation Group hack tool set is associated with advanced persistent threats and may indicate the presence of sophisticated malware or espionage activity. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential long-term compromise and mitigate advanced threat actors leveraging legacy or unknown attack vectors.

YARA Rule

rule EquationGroup_porkserver_v3_0_0 {
   meta:
      description = "Equation Group hack tool set"
      author = "Florian Roth"
      reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
      date = "2017-04-09"
      hash1 = "7b5f86e289047dd673e8a09438d49ec43832b561bac39b95098f5bf4095b8b4a"
   strings:
      $s1 = "%s: %s rpcprog=%d, rpcvers = %d/%d, proto=%s, wait.max=%d.%d, user.group=%s.%s builtin=%lx server=%s" fullword ascii
      $s2 = "%s/%s server failing (looping), service terminated" fullword ascii
      $s3 = "getpwnam: %s: No such user" fullword ascii
      $s4 = "execv %s: %m" fullword ascii
      $s5 = "%s/%s: getsockname: %m" fullword ascii
   condition:
      ( uint16(0) == 0x457f and filesize < 70KB and 4 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Scenario: Legitimate System Maintenance Task
Description: A system administrator is running a scheduled maintenance job that uses the Equation Group tool for disk cleanup or system optimization.
Filter/Exclusion: Exclude processes initiated by scheduled tasks with the Task Scheduler or at.exe command, or filter by process name like cleanmgr.exe or diskcleanup.exe.
Scenario: Security Tool or Antivirus Scan
Description: A third-party security tool or antivirus software is using the Equation Group toolset as part of its scanning or remediation process.
Filter/Exclusion: Exclude processes associated with known security tools (e.g., Malwarebytes, Bitdefender, Kaspersky) or filter by process names like mbam.exe, bdscan.exe, or kavsvc.exe.
Scenario: Software Update or Patch Deployment
Description: A patching tool or update manager is using the Equation Group toolset to deploy system updates or patches across the network.
Filter/Exclusion: Exclude processes initiated by patch management tools like Wsusutil.exe, SCCM, or Update.exe, or filter by IP addresses associated with the internal patch server.
Scenario: Legitimate Data Migration or Backup Tool
Description: A data migration or backup tool (e.g., Veeam, Acronis, or rsync) is using the Equation Group toolset for data transfer or replication.
Filter/Exclusion: Exclude processes associated with backup tools (e.g., veeam.exe, acronis.exe, rsync.exe) or filter by user accounts with known backup privileges.
Scenario: Custom Script or Automation Tool
Description: A custom script or automation tool (e.g., `PowerShell