huntrule

Linux Command-Line Indicators of Equation Group Tooling

Flags execution of known suspicious Linux shell command patterns tied to Equation Group-style scripting and tooling.

FreeReviewedSigma · High · v3
Product
linux
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-04-09
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux shell commands containing specific suspicious strings associated with Equation Group scripts and tools. The matched activity is notable because it often involves privilege/permission changes, log manipulation, and command-and-control or shell-staging behavior using common utilities. It relies on process or command-line telemetry that includes the full command text for keyword matching.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange
Suspicious Reverse Shell via Dev TCP or Netcat
Suspicious Base64 Decoded Payload Piped to Shell
Suspicious Shell Spawned by ActiveMQ Java Process
Suspicious Bad Apples Reverse Shell via socat pty
Suspicious Axios NPM macOS Persistence Masquerading as Apple Service
Malicious Shell Payload Piped from curl to zsh
Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)
Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)
Suspicious Shell Spawned by PostgreSQL Server Process (via process_creation)
Linux Command-Line Indicators of Equation Group Tooling
Pivot detection · T1059.004 · 9 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.