Equation Editor Spawning MSHTA

Duo Tech@duotech

•updated Feb 10, 2026•1•0•26

Monitors for the Microsoft Equation Editor process (EQNEDT32.exe) spawning an MSHTA process (mshta.exe). This behavior is highly indicative of CVE-2018-0802 exploitation, as seen in XWorm campaigns.