huntrule

Linux Command-Line Indicators of Equation Group Tooling

Flags execution of known suspicious Linux shell command patterns tied to Equation Group-style scripting and tooling.

FreeReviewedSigma · High · v3
Product
linux
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2017-04-09
Updated
2026-07-31
AnalysisDetection
title: Linux Command-Line Indicators of Equation Group Tooling
id: 59e31eb1-f9eb-4499-be20-92ba6c9e76b6
status: test
description: This rule flags Linux shell commands containing specific suspicious strings associated with Equation Group scripts and tools. The matched activity is notable because it often involves privilege/permission changes, log manipulation, and command-and-control or shell-staging behavior using common utilities. It relies on process or command-line telemetry that includes the full command text for keyword matching.
references:
  - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_apt_equationgroup_lnx.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-04-09
modified: 2021-11-27
tags:
  - attack.execution
  - attack.g0020
  - attack.t1059.004
logsource:
  product: linux
detection:
  keywords:
    - "chown root*chmod 4777 "
    - cp /bin/sh .;chown
    - chmod 4777 /tmp/.scsi/dev/bin/gsh
    - chown root:root /tmp/.scsi/dev/bin/
    - chown root:root x;
    - /bin/telnet locip locport < /dev/console | /bin/sh
    - /tmp/ratload
    - "ewok -t "
    - "xspy -display "
    - cat > /dev/tcp/127.0.0.1/80 <<END
    - rm -f /current/tmp/ftshell.latest
    - "ghost_* -v "
    - " --wipe > /dev/null"
    - ping -c 2 *; grep * /proc/net/arp >/tmp/gx
    - iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;
    - "> /var/log/audit/audit.log; rm -f ."
    - cp /var/log/audit/audit.log .tmp
    - sh >/dev/tcp/* <&1 2>&1
    - ncat -vv -l -p * <
    - nc -vv -l -p * <
    - < /dev/console | uudecode && uncompress
    - sendmail -osendmail;chmod +x sendmail
    - /usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron
    - chmod 666 /var/run/utmp~
    - chmod 700 nscd crond
    - cp /etc/shadow /tmp/.
    - </dev/console |uudecode > /dev/null 2>&1 && uncompress
    - chmod 700 jp&&netstat -an|grep
    - uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755
    - chmod 700 crond
    - wget http*; chmod +x /tmp/sendmail
    - chmod 700 fp sendmail pt
    - chmod 755 /usr/vmsys/bin/pipe
    - chmod -R 755 /usr/vmsys
    - chmod 755 $opbin/*tunnel
    - chmod 700 sendmail
    - chmod 0700 sendmail
    - /usr/bin/wget http*sendmail;chmod +x sendmail;
    - "&& telnet * 2>&1 </dev/console"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 41e5c73d-9983-4b69-bd03-e13b67e9623c
    type: derived