attack.g0020 | Detection.FYI

Equation Group C2 Communication

Aug 12, 2024 · attack.command-and-control attack.g0020 attack.t1041 detection.emerging-threats ·
Share on:

Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Read More
Equation Group DLL_U Export Function Load

Aug 12, 2024 · attack.g0020 attack.defense-evasion attack.t1218.011 detection.emerging-threats ·
Share on:

Detects a specific export function name used by one of EquationGroup tools

Read More
Equation Group Indicators

Aug 12, 2024 · attack.execution attack.g0020 attack.t1059.004 ·
Share on:

Detects suspicious shell commands used in various Equation Group scripts and tools

Read More
Potential Operation Triangulation C2 Beaconing Activity - DNS

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Read More
Potential Operation Triangulation C2 Beaconing Activity - Proxy

Aug 12, 2024 · attack.command-and-control attack.g0020 detection.emerging-threats ·
Share on:

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Read More