Anvilogic medium experimental other

Abuse EQNEDT32.EXE [snowflake-crowdstrikefdr_process]

Detects potential malicious Microsoft Office payload (CVE-2017-11882 or CVE-2018-0798) on host. Equation Editor. -- Threat Actor Association: Bitter APT, Lotus Blossom, SideWinder, TA428, Tonto Team - Software Association: Soul

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and parent_process_name ilike '%EQNEDT32.EXE%'

Field Validations

Loading…

Comments (0)

Loading comments...