Detects EquationGroup Tool - April Leak

Hunt Hypothesis

The hypothesis is that the detection of EquationGroup Tool - April Leak indicates potential adversary use of legacy malware associated with advanced persistent threats. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify and mitigate long-lived, stealthy threats that may have evaded traditional detection mechanisms.

YARA Rule

rule EquationGroup_Toolset_Apr17_PC_Exploit {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0"
   strings:
      $s1 = "\\\\.\\pipe\\pcheap_reuse" fullword wide
      $s2 = "**** FAILED TO DUPLICATE SOCKET ****" fullword wide
      $s3 = "**** UNABLE TO DUPLICATE SOCKET TYPE %u ****" fullword wide
      $s4 = "YOU CAN IGNORE ANY 'ServiceEntry returned error' messages after this..." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 20KB and 1 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Scenario: Scheduled System Maintenance Task
Description: A legitimate scheduled task (e.g., schtasks.exe) runs a script that mimics the behavior of the EquationGroup tool, such as file creation or registry modification.
Filter/Exclusion: Check the process name and command line for schtasks.exe or use a filter like process.name = "schtasks.exe".
Scenario: Windows Update or Patching Process
Description: The Windows Update agent (wuauclt.exe) or patching tools may perform similar actions to the EquationGroup tool, such as downloading files or modifying system configurations.
Filter/Exclusion: Exclude processes associated with Windows Update using process.name = "wuauclt.exe" or check for known update-related hashes.
Scenario: Legitimate File Integrity Monitoring Tool
Description: A tool like Sysmon or File Integrity Monitor (FIM) may generate similar alerts when it detects changes to system files or registry keys.
Filter/Exclusion: Use a filter like process.name = "sysmon64.exe" or check the tool’s known behavior in the environment.
Scenario: Admin Performing Manual File Cleanup
Description: An administrator manually deletes or modifies files in system directories (e.g., C:\Windows\System32) as part of routine maintenance.
Filter/Exclusion: Filter by user context (e.g., user.name = "Administrator") or check for known admin activity patterns.
Scenario: Third-Party Antivirus or Security Software
Description: Antivirus tools like Malwarebytes or Bitdefender may perform file analysis or quarantine actions that resemble EquationGroup behavior.
Filter/Exclusion: Exclude processes associated with known security tools using process.name = "mbam.exe" or