YARA rules for Operation Triangulation
1 rules · scoped to actor · back to Operation Triangulation
YARA rules whose family, name, or description matches this actor or its tooling. Use these for binary-pattern hunts.
rule APT_Equation_Group_Op_Triangulation_TriangleDB_Implant_Jun23_1 {
meta:
description = "Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)"
author = "Florian Roth"
reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
date = "2023-06-21"
score = 80
id = "d81a5103-41c8-5dba-a560-8fb5514f6c0a"
strings:
$s1 = "unmungeHexString" ascii fullword
$s2 = "CRPwrInfo" ascii fullword
$s3 = "CRConfig" ascii fullword
$s4 = "CRXConfigureDBServer" ascii fullword
condition:
( uint16(0) == 0xfacf and filesize < 30MB and $s1 and 2 of them )
or all of them
}