Network Connection Initiated By Eqnedt32.EXE

Title: Network Connection Initiated By Eqnedt32.EXE
Status: test
Description:Detects network connections from the Equation Editor process "eqnedt32.exe".
References:
  -https://twitter.com/forensicitguy/status/1513538712986079238
  -https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/
  -https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/
Author: Max Altgelt (Nextron Systems)
Date: 2022-04-14
modified:2024-05-31
Tags:

• -'attack.execution'
• -'attack.t1203'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Image|endswith: '\eqnedt32.exe'
  condition:selection
Falsepositives:
  -Unlikely
Level: high