Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
3
1
1
Categories
5
3
2
Platforms
5
Products / Services
2
2
1
MITRE Techniques
5
3
3
2
2
CVEs
71
71
64
58
49
Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.
Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity.
Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.
Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.
Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.
Detects the execution of "RegAsm.exe" without any command-line flags or specified files. This behavior is unusual for legitimate use of RegAsm.exe, which typically registers .NET assemblies or displays help information. Such execution patterns can indicate an attempt at process injection or other forms of defense evasion by adversaries abusing a trusted Windows utility.
Detects exploits that leverage CVE-2017-11882 by monitoring for the execution of EQNEDT32.EXE as a parent process, which is indicative of the vulnerability being exploited to launch further malicious processes like mshta.exe.