Anvilogic medium experimental spl

Abuse EQNEDT32.EXE [splunk-edr]

Detects potential malicious Microsoft Office payload (CVE-2017-11882 or CVE-2018-0798) on host. Equation Editor. -- Threat Actor Association: Bitter APT, Lotus Blossom, SideWinder, TA428, Tonto Team - Software Association: Soul

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` ((event_type IN ("childproc","netconn","proc")) 
OR (TERM(ProcessRollup2) 
OR Type=Process) 
OR TERM(DeviceProcessEvents)) "EQNEDT32.EXE"
| table _time, host, user _time, host, session_id, process, signature_id, parent_process_name, process_name, user
| bin span=300s
| stats values(*) as * by _time, host
| where match(parent_process_name, "(?i)EQNEDT32.EXE")
| table _time, host, user _time, host, session_id, process, signature_id, parent_process_name, user `hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...