detection.wiki

Detection rules › Sigma

Equation Group C2 Communication

Status
test
Severity
high
Log source
category firewall
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1041 Exfiltration Over C2 Channel

Rule body yaml

title: Equation Group C2 Communication
id: 881834a4-6659-4773-821e-1c151789d873
status: test
description: Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools
references:
    - https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
    - https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
author: Florian Roth (Nextron Systems)
date: 2017-04-15
modified: 2021-11-27
tags:
    - attack.exfiltration
    - attack.command-and-control
    - attack.g0020
    - attack.t1041
    - detection.emerging-threats
logsource:
    category: firewall
detection:
    selection:
        - dst_ip:
              - '69.42.98.86'
              - '89.185.234.145'
        - src_ip:
              - '69.42.98.86'
              - '89.185.234.145'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    - dst_ip:
          - '69.42.98.86'
          - '89.185.234.145'
    - src_ip:
          - '69.42.98.86'
          - '89.185.234.145'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
dst_ipeq
  • 69.42.98.86
  • 89.185.234.145
src_ipeq
  • 69.42.98.86
  • 89.185.234.145