huntrule

Windows Network Connections Initiated by Eqnedt32.EXE

Identifies outbound network connections started by eqnedt32.exe on Windows.

FreeReviewedSigma · High · v2
Product
windows
Category
network_connection
Author
Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-04-14
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags outbound or inbound network connections where the initiating process image ends with eqnedt32.exe (Microsoft Equation Editor). Attackers may abuse Equation Editor to execute malicious code that communicates over the network. The detection relies on Windows network connection telemetry that includes the connecting process image path.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange
Suspicious Chrome Browser Process Spawned by Outlook Indicating Sandbox Escape
Suspicious Equation Editor Child Process via Process Creation
Malicious MSDT Command Line Invoking Follina Payload (via process_creation)
Malicious WPS Office ksoqing Protocol Handler Exploitation via Process Creation
Malicious Startup LNK Dropped by WinRAR via CVE-2025-8088 Path Traversal
Malicious Equation Editor Child Process Indicating Exploit
Malicious Foomatic-Rip Filter Spawning Shell via CUPS Exploitation
Suspicious Child Process Spawned by WinRAR via Process Creation
Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831
Windows Network Connections Initiated by Eqnedt32.EXE
Pivot detection · T1203 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.