Equation Editor Spawning Shell

Dave Raphael Galarosa@vexalius

•updated Jan 16, 2026•0•39

Detects the Microsoft Equation Editor (EQNEDT32.EXE) spawning a shell process. This behavior is highly anomalous and is a strong indicator of exploitation of vulnerabilities like CVE-2017-11882, as seen in a Remcos RAT campaign.