Word Remote Template leading to Equation Editor

nomit vyas@xoxo

•updated Jun 23, 2026•1•0•1

Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.