Equation Group C2 Communication

testhigh
log source: firewallauthor Florian Roth (Nextron Systems)date 2017-04-15
01

description

What this is, in brief.

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

02

tags

attack.exfiltrationattack.command-and-controlattack.g0020attack.t1041detection.emerging-threats
03

rule source (YAML)

title: Equation Group C2 Communication
id: 881834a4-6659-4773-821e-1c151789d873
status: test
description: Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools
references:
    - https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
    - https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
author: Florian Roth (Nextron Systems)
date: 2017-04-15
modified: 2021-11-27
tags:
    - attack.exfiltration
    - attack.command-and-control
    - attack.g0020
    - attack.t1041
    - detection.emerging-threats
logsource:
    category: firewall
detection:
    selection:
        - dst_ip:
              - '69.42.98.86'
              - '89.185.234.145'
        - src_ip:
              - '69.42.98.86'
              - '89.185.234.145'
    condition: selection
falsepositives:
    - Unknown
level: high
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

groups named (1)

Threat groups associated with this.

06

references

External citations — patches, advisories, analysis.