{"id":"41e5c73d-9983-4b69-bd03-e13b67e9623c","title":"Equation Group Indicators","description":"Detects suspicious shell commands used in various Equation Group scripts and tools","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-04-09","modified":"2021-11-27","tags":["attack.execution","attack.g0020","attack.t1059.004"],"technique_ids":["T1059.004"],"logsource":{"product":"linux"},"falsepositives":["Unknown"],"references":["https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"],"source_path":"rules/linux/builtin/lnx_apt_equationgroup_lnx.yml","source_sha256":"39d4bc254ac74c81d226308e39c2887eff0c6696c7cceaac57dd231bbfe449f6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_apt_equationgroup_lnx.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Equation Group Indicators\nid: 41e5c73d-9983-4b69-bd03-e13b67e9623c\nstatus: test\ndescription: Detects suspicious shell commands used in various Equation Group scripts and tools\nreferences:\n    - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-04-09\nmodified: 2021-11-27\ntags:\n    - attack.execution\n    - attack.g0020\n    - attack.t1059.004\nlogsource:\n    product: linux\ndetection:\n    keywords:\n        # evolvingstrategy, elgingamble, estesfox\n        - 'chown root*chmod 4777 '\n        - 'cp /bin/sh .;chown'\n        # tmpwatch\n        - 'chmod 4777 /tmp/.scsi/dev/bin/gsh'\n        - 'chown root:root /tmp/.scsi/dev/bin/'\n        # estesfox\n        - 'chown root:root x;'\n        # ratload\n        - '/bin/telnet locip locport < /dev/console | /bin/sh'\n        - '/tmp/ratload'\n        # ewok\n        - 'ewok -t '\n        # xspy\n        - 'xspy -display '\n        # elatedmonkey\n        - 'cat > /dev/tcp/127.0.0.1/80 <<END'\n        # ftshell\n        - 'rm -f /current/tmp/ftshell.latest'\n        # ghost\n        - 'ghost_* -v '\n        # morerats client\n        - ' --wipe > /dev/null'\n        # noclient\n        - 'ping -c 2 *; grep * /proc/net/arp >/tmp/gx'\n        - 'iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;'\n        # auditcleaner\n        - '> /var/log/audit/audit.log; rm -f .'\n        - 'cp /var/log/audit/audit.log .tmp'\n        # reverse shell\n        - 'sh >/dev/tcp/* <&1 2>&1'\n        # packrat\n        - 'ncat -vv -l -p * <'\n        - 'nc -vv -l -p * <'\n        # empty bowl\n        - '< /dev/console | uudecode && uncompress'\n        - 'sendmail -osendmail;chmod +x sendmail'\n        # echowrecker\n        - '/usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron'\n        # dubmoat\n        - 'chmod 666 /var/run/utmp~'\n        # poptop\n        - 'chmod 700 nscd crond'\n        # abopscript\n        - 'cp /etc/shadow /tmp/.'\n        # ys\n        - '</dev/console |uudecode > /dev/null 2>&1 && uncompress'\n        # jacktelnet\n        - 'chmod 700 jp&&netstat -an|grep'\n        # others\n        - 'uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755'\n        - 'chmod 700 crond'\n        - 'wget http*; chmod +x /tmp/sendmail'\n        - 'chmod 700 fp sendmail pt'\n        - 'chmod 755 /usr/vmsys/bin/pipe'\n        - 'chmod -R 755 /usr/vmsys'\n        - 'chmod 755 $opbin/*tunnel'\n        - 'chmod 700 sendmail'\n        - 'chmod 0700 sendmail'\n        - '/usr/bin/wget http*sendmail;chmod +x sendmail;'\n        - '&& telnet * 2>&1 </dev/console'\n    condition: keywords\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"}],"data_path":"data/detection-rules/41e5c73d-9983-4b69-bd03-e13b67e9623c.json","kind":"sigma"}