← Back to SOC feed Coverage →

Equation Group Malware - HDD reprogramming module

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-23T11:00:00Z · Confidence: medium

Hunt Hypothesis

The detection identifies potential HDD reprogramming activity associated with Equation Group malware, which may indicate unauthorized low-level disk manipulation. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect advanced persistent threats that could compromise data integrity and system control.

YARA Rule

rule Equation_Kaspersky_HDD_reprogramming_module 
{

    meta:
        description = "Equation Group Malware - HDD reprogramming module"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
    
    strings:
        $mz = { 4d 5a }
        $s0 = "nls_933w.dll" fullword ascii
        $s1 = "BINARY" fullword wide
        $s2 = "KfAcquireSpinLock" fullword ascii
        $s3 = "HAL.dll" fullword ascii
        $s4 = "READ_REGISTER_UCHAR" fullword ascii
    condition:
        ( $mz at 0 ) and filesize < 300000 and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/APT_Equation.yar