Detection rules › Kusto Query Language

Suspicious Process Injection from Office application

Source
upstream

This query detects process injections using CreateRemoteThread, QueueUserAPC or SetThread context APIs, originating from an Office process (only Word/Excel/PowerPoint)that might contains macros. Performing process injection from a macro is a common technique by attackers to escape out of the Office process into something longer running.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1204 User Execution

Event coverage

ProviderEvent IDTitle
Sysmon8CreateRemoteThread
Defender-DeviceEvents9007004CreateRemoteThread API call

Stages and Predicates

Stage 1: source

DeviceEvents

Stage 2: where

ActionType in ["CreateRemoteThreadApiCall", "QueueUserApcRemoteApiCall", "SetThreadContextRemoteApiCall"]

Stage 3: where

InitiatingProcessFileName in ["excel.exe", "powerpnt.exe", "winword.exe"]

Stage 4: where

not
  InitiatingProcessCommandLine contains "/dde"

Stage 5: where

not
  InitiatingProcessCommandLine match [".docx", "dotx", ".xlsx", ".xltx", ".pptx"]

Exclusions

Top-level NOT(...) conjuncts — predicates this rule actively suppresses.

StageFieldKindExcluded values
1CommandLinecontains/dde
1CommandLinematch.docx, dotx, .xlsx, .xltx, .pptx

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ActionTypein
  • CreateRemoteThreadApiCall
  • QueueUserApcRemoteApiCall
  • SetThreadContextRemoteApiCall
InitiatingProcessFileNamein
  • excel.exe
  • powerpnt.exe
  • winword.exe