Network Connection Initiated By Eqnedt32.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects network connections initiated by the Microsoft Equation Editor process (eqnedt32.exe). This activity is highly suspicious as eqnedt32.exe is not expected to make outbound network connections and is often exploited by adversaries to achieve code execution and establish C2 communications.