Abuse EQNEDT32.EXE (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Detects potential malicious Microsoft Office payload (CVE-2017-11882 or CVE-2018-0798) on host. Equation Editor

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

References

https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: '1074.1113'
title: Abuse EQNEDT32.EXE
description: 'Detects potential malicious Microsoft Office payload (CVE-2017-11882
  or CVE-2018-0798) on host. Equation Editor. -- Threat Actor Association: Bitter
  APT, Lotus Blossom, SideWinder, TA428, Tonto Team - Software Association: Soul'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<") "EQNEDT32.EXE"| table _time, host, user _time, host, session_id,
  process, signature_id, parent_process_name, process_name, user| bin span=300s |
  stats values(*) as * by _time, host | where match(parent_process_name, "(?i)EQNEDT32.EXE")
  | table _time, host, user _time, host, session_id, process, signature_id, parent_process_name,
  user `hec_collect`'
techniques:
- execution:exploitation for client execution
technique_id: 
- T1203
data_category:
- Windows event logs
references:
- https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<") "EQNEDT32.EXE"

Stage 2: `table`

| table _time, host, user _time, host, session_id, process, signature_id, parent_process_name, process_name, user

Stage 3: `bucket`

| bin span=300s

Stage 4: `stats`

| stats values(*) as * by _time, host

Stage 5: `where`

| where match(parent_process_name, "(?i)EQNEDT32.EXE")

Stage 6: `table`

| table _time, host, user _time, host, session_id, process, signature_id, parent_process_name, user `hec_collect`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`parent_process_name`	regex_match	`"(?i)EQNEDT32.EXE"` corpus 2 (splunk 2)	`field:"parent_process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4688<"`
1	`"EQNEDT32.EXE"`