Detectionhightest

Network Connection Initiated By Eqnedt32.EXE

Detects network connections from the Equation Editor process "eqnedt32.exe".

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Max Altgelt (Nextron Systems)Created Thu Apr 14Updated Fri May 31a66bc059-c370-472c-a0d7-f8fd1bf9d583windows

Log Source

WindowsNetwork Connection

ProductWindows← raw: windows

CategoryNetwork Connection← raw: network_connection

Events for outbound and inbound network connections including DNS resolution.

Detection Logic

detection:
    selection:
        Image|endswith: '\eqnedt32.exe'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

a66bc059-c370-472c-a0d7-f8fd1bf9d583

Status

test

Level

high

Type

Detection

Created

Thu Apr 14

Modified

Fri May 31

Author

Path

rules/windows/network_connection/net_connection_win_eqnedt.yml

Raw Tags

attack.executionattack.t1203