Detects EquationGroup Tool - April Leak

Hunt Hypothesis

The hypothesis is that the detection of EquationGroup Tool - April Leak indicates potential adversary use of a sophisticated, legacy malware toolkit often associated with advanced persistent threats. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate long-term, stealthy adversary presence that may evade traditional detection methods.

YARA Rule

rule EquationGroup_Toolset_Apr17__ELV_ESKE_EVFR_16 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      super_rule = 1
      hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
      hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
      hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
   strings:
      $x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
      $x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
      $s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
      $s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
      $s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Scenario: Scheduled System Maintenance Task
Description: A legitimate scheduled task runs a script that uses certutil or PowerShell to perform certificate validation or system updates, which may trigger the detection logic.
Filter/Exclusion: Exclude processes associated with Task Scheduler or processes with CommandLine containing schtasks.exe or scheduling.
Scenario: Certificate Authority (CA) Operations
Description: A system administrator uses certutil to manage or renew certificates, which may match the behavior of the EquationGroup tool.
Filter/Exclusion: Exclude processes with ProcessName equal to certutil.exe or CommandLine containing certutil -renew or certutil -addstore.
Scenario: PowerShell Script for Log Analysis
Description: A security team runs a PowerShell script that uses certutil to analyze certificate logs or check for expired certificates, which may trigger the rule.
Filter/Exclusion: Exclude processes with ProcessName equal to powershell.exe and CommandLine containing Get-ChildItem or Get-Certificate.
Scenario: Windows Update or Patching Job
Description: A patching job or Windows Update process uses certutil to validate updates, which may be flagged by the detection logic.
Filter/Exclusion: Exclude processes with ProcessName equal to wuauclt.exe or wuauserv or CommandLine containing wuauclt.exe.
Scenario: Internal Certificate Management Tool
Description: An internal tool or script used by the enterprise for managing internal certificates may use certutil in a way that resembles the EquationGroup tool’s behavior.
Filter/Exclusion: Exclude processes with ProcessName equal to certutil.exe and