huntrule

Linux Command-Line Indicators of Equation Group Tooling

Flags execution of known suspicious Linux shell command patterns tied to Equation Group-style scripting and tooling.

FreeReviewedSigma · High · v3
Product
linux
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-04-09
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux shell commands containing specific suspicious strings associated with Equation Group scripts and tools. The matched activity is notable because it often involves privilege/permission changes, log manipulation, and command-and-control or shell-staging behavior using common utilities. It relies on process or command-line telemetry that includes the full command text for keyword matching.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange
Possible Remote Payload Download And Execution via Shell (via process_creation)
Suspicious EtherRAT Node.js Implant Background Execution via Shell (via process_creation)
Malicious EtherRAT Base64 Decoded Payload Piped To Bash via Shell (via process_creation)
Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell
Malicious Download Piped to Shell via curl or wget (via process_creation)
Suspicious GobRAT Bulbature Infection Shell Scripts Execution
Suspicious Base64 Decoded Payload Piped to Shell on Linux
Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)
Suspicious OpenClaw Skill File Modification via File Event
Linux Command-Line Indicators of Equation Group Tooling
Pivot detection · T1059.004 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.