CVE2017

CVE-2017-11882

1Rules

3References

1Folders

2021-11-27Latest

Summary

CVE-2017-11882 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2017. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threatcriticalstable

Droppers Exploiting CVE-2017-11882

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

WindowsProcess Creation

TA0002 · ExecutionT1203 · Exploitation for Client ExecutionT1204.002 · Malicious FileTA0001 · Initial Access+3

Florian Roth (Nextron Systems)Thu Nov 232017

References