Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent
Flags Windows process creation where EQNEDT32.EXE is the parent, matching CVE-2017-11882 exploitation dropper behavior.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-11-23
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creations where the parent process path ends with EQNEDT32.EXE, consistent with exploitation and dropper behavior associated with CVE-2017-11882. EQNEDT32.EXE spawning additional processes can indicate an attacker has executed an Office-related exploit path to launch further payload stages. It relies on Windows process creation telemetry that includes ParentImage and process path information.
Reporting behind it
- hybrid-analysis.comhttps://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
- linkedin.comhttps://www.linkedin.com/pulse/exploit-available-dangerous-ms-office-rce-vuln-called-thebenygreen-
- github.comhttps://github.com/embedi/CVE-2017-11882
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent"
id: d284c935-1d6f-4f57-a3ec-bbca4e0172db
status: stable
description: This rule flags process creations where the parent process path ends with EQNEDT32.EXE, consistent with exploitation and dropper behavior associated with CVE-2017-11882. EQNEDT32.EXE spawning additional processes can indicate an attacker has executed an Office-related exploit path to launch further payload stages. It relies on Windows process creation telemetry that includes ParentImage and process path information.
references:
- https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
- https://www.linkedin.com/pulse/exploit-available-dangerous-ms-office-rce-vuln-called-thebenygreen-
- https://github.com/embedi/CVE-2017-11882
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-23
modified: 2021-11-27
tags:
- attack.execution
- attack.t1203
- attack.t1204.002
- attack.initial-access
- attack.t1566.001
- cve.2017-11882
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \EQNEDT32.EXE
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 678eb5f4-8597-4be6-8be7-905e4234b53a
type: derived