Microsoft Equation Editor Child Process

[rule]
description = """
Identifies suspicious child processes of the Microsoft Equation Editor process, which is frequently targeted by
attackers using weaponized Microsoft Office documents. These child processes are often launched during exploitation of
Office applications via known vulnerabilities CVE-2017-1182 or CVE-2018-0798.
"""
id = "60eb5960-b26e-494a-8cf2-35ab5939f6c1"
license = "Elastic License v2"
name = "Microsoft Equation Editor Child Process"
os_list = ["windows"]
reference = [
    "https://www.anomali.com/blog/multiple-chinese-threat-groups-exploiting-cve-2018-0798-equation-editor-vulnerability-since-late-2018",
    "https://nvd.nist.gov/vuln/detail/CVE-2017-11882",
    "https://nvd.nist.gov/vuln/detail/CVE-2018-0798",
]
version = "1.0.31"

query = '''
process where event.action == "start" and process.parent.name : "EQNEDT32.EXE" and
  not process.executable : ("?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\SysWOW64\\WerFault.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"