eqnedt32.exe

Program on Windows 12 Sigma rules name it

Is it the real eqnedt32.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma process creation rules that name eqnedt32.exe

highPotential Exploitation Attempt From Office ApplicationChristian Burkard (Nextron Systems), @SBousseaden (idea)

highSuspicious Binary In User Directory Spawned From Office ApplicationJason Lynch

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious WMIC Execution Via Office ProcessVadim Khrykov, Cyb3rEng

mediumSuspicious New Instance Of An Office COM ObjectNasreddine Bencherchali (Nextron Systems)

Sigma names eqnedt32.exe in 12 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.