Equation Group C2 Communication

Description

Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml Questions via Twitter: @janvonkirchheim.

Query · kql

DeviceProcessEvents 
| where Timestamp > ago(7d)
| where (FolderPath endswith @"\rundll32.exe" and ProcessCommandLine endswith ",dll_u") 
        or ProcessCommandLine has " -export dll_u "
| top 100 by Timestamp desc
Raw source Equation Group C2 Communication · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4f0fdeab-1d34-4c1e-9121-8ac800988de8
name: Equation Group C2 Communication
description: |
  Original Sigma Rule: https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  | where (FolderPath endswith @"\rundll32.exe" and ProcessCommandLine endswith ",dll_u") 
          or ProcessCommandLine has " -export dll_u "
  | top 100 by Timestamp desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.