Equation Group DLL_U Export Function Load

Detects a specific export function name used by one of EquationGroup tools

Detection logic

selection

- CommandLine|contains: -export dll_u
- CommandLine|endswith:
    - ",dll_u"
    - " dll_u"

Condition

selection

Raw YAML

title: Equation Group DLL_U Export Function Load
id: d465d1d8-27a2-4cca-9621-a800f37cf72e
status: stable
description: Detects a specific export function name used by one of EquationGroup tools
references:
    - https://github.com/00derp/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
    - https://twitter.com/cyb3rops/status/972186477512839170
author: Florian Roth (Nextron Systems)
date: 2019-03-04
modified: 2023-03-09
tags:
    - attack.stealth
    - attack.g0020
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|contains: '-export dll_u'
        - CommandLine|endswith:
              - ',dll_u'
              - ' dll_u'
    condition: selection
falsepositives:
    - Unlikely
level: critical

False positives

Unlikely

References

Similar rules

APT29 2018 Phishing Campaign CommandLine Indicators

critical

windows · Shares T1218

EvilNum APT Golden Chickens Deployment Via OCX Files

critical

windows · Shares T1218

Fireball Archer Install

high

windows · Shares T1218

IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

high

windows · Shares T1218