Query: Sigma rule for Detects suspicious shell commands used in various Equation Group scripts and tools
Matching passage: Sigma rule: Detects suspicious shell commands used in various Equation Group scripts and tools. Logsource: linux. Rule: title: Equation Group Indicators id: 41e5c73d-9983-4b69-bd03-e13b67e9623c status: test description: Detects suspicious shell commands used in various Equation Group scripts and tools references: - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1 author: Florian Roth (Nextron Systems) date: 2017-04-09 modified: 2021-11-27 tags: - attack.execution - attack.g0020 - attack.t1059.004 logsource: product: linux detection: keywords: - 'chown root*chmod 4777 ' - cp /bin/sh .;chown - chmod 4777 /tmp/.scsi/dev/bin/gsh - chown root:root /tmp/.scsi/dev/bin/ - chown root:root x; - /bin/telnet locip locport < /dev/console | /bin/sh - /tmp/ratload - 'ewok -t ' - 'xspy -display ' - cat > /dev/tcp/127.0.0.1/80 <<END - rm -f /current/tmp/ftshell.latest - 'ghost_* -v ' - ' --wipe > /dev/null' - ping -c 2 *; grep * /proc/net/arp >/tmp/gx - iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP; - '> /var/log/audit/audit.log; rm -f .' - cp /var/log/audit/audit.log .tmp - sh >/dev/tcp/* <&1 2>&1 - ncat -vv -l -p * < - nc -vv -l -p * < - < /dev/console | uudecode && uncompress - sendmail -osendmail;chmod +x sendmail - /usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron - chmod 666 /var/run/utmp~ - chmod 700 nscd crond - cp /etc/shadow /tmp/. - </dev/console |uudecode > /dev/null 2>&1 && uncompress - chmod 700 jp&&netstat -an|grep - uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755 - chmod 700 crond - wget http*; chmod +x /tmp/sendmail - chmod 700 fp sendmail pt - chmod 755 /usr/vmsys/bin/pipe - chmod -R 755 /usr/vmsys - chmod 755 $opbin/*tunnel - chmod 700 sendmail - chmod 0700 sendmail - /usr/bin/wget http*sendmail;chmod +x sendmail; - '&& telnet * 2>&1 </dev/console' condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, cre. Logsource: windows / file_event. Rule: title: Suspicious File Created by ArcSOC.exe id: e890acee-d488-420e-8f20-d9b19b3c3d43 status: experimental description: 'Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.command-and-control - attack.persistence - attack.initial-access - attack.execution - attack.stealth - attack.t1127 - attack.t1105 - attack.t1133 logsource: category: file_event product: windows detection: selection: Image|endswith: \ArcSOC.exe TargetFilename|endswith: - .ahk - .aspx - .au3 - .bat - .cmd - .dll - .exe - .hta - .js - .ps1 - .py - .vbe - .vbs - .wsf condition: selection falsepositives: - Unlikely level: high