Windows CVE-2017-11882 Droppers Launching EQNEDT32.EXE and Child Processes

title: Windows CVE-2017-11882 Droppers Launching EQNEDT32.EXE and Child Processes
id: d284c935-1d6f-4f57-a3ec-bbca4e0172db
status: stable
description: This rule identifies process creation events where the parent process image ends with EQNEDT32.EXE, consistent with activity attributed to droppers exploiting CVE-2017-11882 to launch EQNEDT32.EXE and related child processes. Such staged execution is commonly used to run additional payloads under a parent that appears to be part of the exploitation chain. Telemetry relies on Windows process creation logs that include the parent image path for each spawned process.
references:
  - https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
  - https://www.linkedin.com/pulse/exploit-available-dangerous-ms-office-rce-vuln-called-thebenygreen-
  - https://github.com/embedi/CVE-2017-11882
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-23
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - attack.initial-access
  - attack.t1566.001
  - cve.2017-11882
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \EQNEDT32.EXE
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 678eb5f4-8597-4be6-8be7-905e4234b53a
    type: derived