Detects tool from EQGRP toolset - file teflonhandle.exe

Hunt Hypothesis

The hypothesis is that the presence of teflonhandle.exe, a component of the EQGRP toolset, may indicate the execution of adversary tools used for persistence or lateral movement within a network. SOC teams should proactively hunt for this artifact in Azure Sentinel to identify potential compromise from advanced persistent threats leveraging known malicious tooling.

YARA Rule

rule EQGRP_teflonhandle 
{

    meta:
        description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
        $s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
        $s3 = "Random Key : 0x" fullword ascii
        $s4 = "done (%i bytes written)." fullword ascii
        $s5 = "%s --> %s..." fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 20KB and 2 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

• Research
• Source Rule

False Positive Guidance

• Scenario: Legitimate use of teflonhandle.exe for system diagnostics
  Description: A system administrator uses teflonhandle.exe as part of a routine system health check or performance monitoring tool.
  Filter/Exclusion: Exclude processes where the parent process is a known system diagnostic tool (e.g., perfmon.exe, taskmgr.exe) or where the command line includes diagnostic flags.

• Scenario: Scheduled job running teflonhandle.exe for log cleanup
  Description: A scheduled task runs teflonhandle.exe to clean up temporary files or logs as part of a maintenance routine.
  Filter/Exclusion: Exclude processes where the process is initiated by a scheduled task with a known maintenance job name (e.g., CleanupLogs.job) or where the user account is a service account with limited privileges.

• Scenario: teflonhandle.exe used in a third-party application
  Description: A third-party enterprise application includes teflonhandle.exe as part of its internal toolset for configuration management or deployment.
  Filter/Exclusion: Exclude processes where the executable is located in a known third-party application directory (e.g., C:\Program Files\ThirdPartyApp\) or where the parent process is a known application (e.g., ThirdPartyApp.exe).

• Scenario: teflonhandle.exe used for legitimate network discovery
  Description: A network discovery tool or asset inventory system uses teflonhandle.exe to gather information about network devices or endpoints.
  Filter/Exclusion: Exclude processes where the executable is run from a network inventory tool directory (e.g., C:\NetworkInventory\) or where the command line includes network discovery flags.

• Scenario: teflonhandle.exe used in a security tool for analysis
  Description: A security analyst uses `