Windows Network Connections from eqnedt32.exe (Equation Editor)

title: Windows Network Connections from eqnedt32.exe (Equation Editor)
id: 6ccb8bf8-4937-41aa-a052-4488d9b2c5f2
status: test
description: This rule flags network connections initiated by eqnedt32.exe, the Windows Equation Editor process. Attackers may abuse this executable to reach out over the network during exploitation or follow-on activity. The detection relies on Windows network connection telemetry that includes the initiating process image path, specifically matching images ending with '\eqnedt32.exe'.
references:
  - https://twitter.com/forensicitguy/status/1513538712986079238
  - https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/
  - https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_eqnedt.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2022-04-14
modified: 2024-05-31
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: \eqnedt32.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a66bc059-c370-472c-a0d7-f8fd1bf9d583
    type: derived