Firewall alerts for Equation Group C2 IP communications

title: Firewall alerts for Equation Group C2 IP communications
id: 54ca1b9d-3426-4f49-88ab-221a6b693f56
status: test
description: This rule flags firewall traffic where either the source or destination IP matches two specific IP addresses listed in the rule. Such direct communications to presumed command-and-control endpoints can indicate active attacker-controlled infrastructure. The detection relies on firewall logs that provide source and destination IP telemetry.
references:
  - https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
  - https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-04-15
modified: 2021-11-27
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.g0020
  - attack.t1041
  - detection.emerging-threats
logsource:
  category: firewall
detection:
  selection:
    - dst_ip:
        - 69.42.98.86
        - 89.185.234.145
    - src_ip:
        - 69.42.98.86
        - 89.185.234.145
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 881834a4-6659-4773-821e-1c151789d873
    type: derived