{"id":"a66bc059-c370-472c-a0d7-f8fd1bf9d583","title":"Network Connection Initiated By Eqnedt32.EXE","description":"Detects network connections from the Equation Editor process \"eqnedt32.exe\".","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2022-04-14","modified":"2024-05-31","tags":["attack.execution","attack.t1203"],"technique_ids":["T1203"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Unlikely"],"references":["https://twitter.com/forensicitguy/status/1513538712986079238","https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/","https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/"],"source_path":"rules/windows/network_connection/net_connection_win_eqnedt.yml","source_sha256":"b048bb87dca4cfdf8afc5583af741880c2308f9f05265db3be2705e2a4362a65","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_eqnedt.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Network Connection Initiated By Eqnedt32.EXE\nid: a66bc059-c370-472c-a0d7-f8fd1bf9d583\nstatus: test\ndescription: Detects network connections from the Equation Editor process \"eqnedt32.exe\".\nreferences:\n    - https://twitter.com/forensicitguy/status/1513538712986079238\n    - https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/\n    - https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/\nauthor: Max Altgelt (Nextron Systems)\ndate: 2022-04-14\nmodified: 2024-05-31\ntags:\n    - attack.execution\n    - attack.t1203\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\eqnedt32.exe'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/a66bc059-c370-472c-a0d7-f8fd1bf9d583.json","kind":"sigma"}