Network Connection Initiated By Eqnedt32.EXE
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detection logic
Detection requirements
- Platform
- LinuxmacOSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- windows
- Log source category
- network_connection
Known benign triggers
- Unlikely
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/ | Only this detection cites it |
| news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/ | Only this detection cites it |
| twitter.com/forensicitguy/status/1513538712986079238 | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- a66bc059-c370-472c-a0d7-f8fd1bf9d583
- Tagged by the source as
- attack.execution
Licence
- Published under
- Detection Rule License 1.1Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 26, 2026
- Version
- 1