Droppers Exploiting CVE-2017-11882 via EQNEDT32.EXE
Detects exploits that leverage CVE-2017-11882 by monitoring for the execution of EQNEDT32.EXE as a parent process, which is indicative of the vulnerability being exploited to launch further malicious processes like mshta.exe.
Sigma
