Dave Raphael Galarosa

@vexalius

Completionist

0 followers11 downloads0 copies0 likes39 views

1 detection

Filters

Last updated

All Time

Detection languages

Sigma1

Platforms

Windows1

Products / Services

Windows Event Log (Security)1

MITRE Techniques

S0332 - Remcos1

T1059 - Command and Scripting Interpreter1

T1203 - Exploitation for Client Execution1

TA0002 - Execution1

Equation Editor Spawning Shell

Sigma

Detects the Microsoft Equation Editor (EQNEDT32.EXE) spawning a shell process. This behavior is highly anomalous and is a strong indicator of exploitation of vulnerabilities like CVE-2017-11882, as seen in a Remcos RAT campaign.

Dave Raphael Galarosa@vexalius

Detections.ai Community

10 months ago

0039