Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Flags Windows process creation where EQNEDT32.EXE is the parent, matching CVE-2017-11882 exploitation dropper behavior.

FreeReviewedSigma · Critical · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-11-23
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
- T1203Exploitation for Client Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creations where the parent process path ends with EQNEDT32.EXE, consistent with exploitation and dropper behavior associated with CVE-2017-11882. EQNEDT32.EXE spawning additional processes can indicate an attacker has executed an Office-related exploit path to launch further payload stages. It relies on Windows process creation telemetry that includes ParentImage and process path information.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange

Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious DLL Written to Explorer IconCache Path

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Ursnif C2 Proxy Traffic Identified by Base64 URI Encoding and .avi/.images Pattern

Windows: Suspicious subprocess execution from Hwp.exe spawning gbb.exe

Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)

Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Pivot detection · T1203 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cve-2017-11882-droppers-launching-eqnedt32-exe-and-child-processes-678eb5f4

title: "Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent"
id: d284c935-1d6f-4f57-a3ec-bbca4e0172db
status: stable
description: This rule flags process creations where the parent process path ends with EQNEDT32.EXE, consistent with exploitation and dropper behavior associated with CVE-2017-11882. EQNEDT32.EXE spawning additional processes can indicate an attacker has executed an Office-related exploit path to launch further payload stages. It relies on Windows process creation telemetry that includes ParentImage and process path information.
references:
  - https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
  - https://www.linkedin.com/pulse/exploit-available-dangerous-ms-office-rce-vuln-called-thebenygreen-
  - https://github.com/embedi/CVE-2017-11882
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-23
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - attack.initial-access
  - attack.t1566.001
  - cve.2017-11882
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \EQNEDT32.EXE
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 678eb5f4-8597-4be6-8be7-905e4234b53a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL