
title: Equation Group DLL_U Load
author: Florian Roth
date: 2019/03/04
description: Detects a specific tool and export used by EquationGroup
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\rundll32.exe'
  SELECTION_3:
    CommandLine: '*,dll_u'
  SELECTION_4:
    CommandLine: '* -export dll_u *'
  condition: (SELECTION_1 and ((SELECTION_2 and SELECTION_3) or SELECTION_4))
falsepositives:
- Unknown
id: d465d1d8-27a2-4cca-9621-a800f37cf72e
level: critical
logsource:
  category: process_creation
  product: windows
modified: 2020/08/27
references:
- https://github.com/adamcaudill/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
- https://securelist.com/apt-slingshot/84312/
- https://twitter.com/cyb3rops/status/972186477512839170
status: experimental
tags:
- attack.g0020
- attack.defense_evasion
- attack.t1085
- attack.t1218.011
ruletype: SIGMA
