group

Equation G0020

Created: 31 May 2017
Last modified: 31 July 2026
Alias: Equation

Equation is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives. [1]

TechniquesBottom 13%

TacticsBottom 13%

Tools & malwareNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Equation MITRE reference G0020

Peripheral Device Discovery T1120 ↗

Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.2

Discovery2 detection rules

Environmental Keying T1480.001 ↗

Equation has been observed utilizing environmental keying in payload delivery.3 4

Stealthno detection rules

Component Firmware T1542.002 ↗

Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.5

Persistence · Stealthno detection rules

Hidden File System T1564.005 ↗

Equation has used an encrypted virtual file system stored in the Windows Registry.6

Stealthno detection rules

Standing G0020

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques4Bottom 13%

13th percentile · 87% of 176 ATT&CK groups have more Enterprise techniques.

Tactics3Bottom 13%

13th percentile · 87% of 176 ATT&CK groups have more tactics spanned.

Tools & malware0Bottom 9%

9th percentile · 91% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique0medBottom 5%

5th percentile · 95% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique0med

Equation detections G0020

2 distinct rules cover the 4 techniques recorded for this group. 2 Sigma.

1 covered by at least one rule3 with no coverage2 distinct rules in total

Showing 1-2 of 2 rules

Drag headers to reorder | Drag edges to resize

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
		Attackers may leverage fsutil to enumerated connected drives.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Peripheral Device Discovery	-	low	Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2022-03-29	2022-07-14	63de06b9-a385-40b5-8b32-73f2b9ef84b6
		Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.	Generic	test	ps_script	windows	PowerShell	Discovery Peripheral Device Discovery	-	low	frack113	2021-08-23	2022-12-25	b26647de-4feb-4283-af6b-6117661283c5

Standing G0020

Title

Description