Potentially Suspicious Office Document Executed From Trusted Location

Severity: high
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1202` Indirect Command Execution

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_parent`

or:
ParentImage|endswith: '\dopus.exe'
ParentImage|endswith: '\explorer.exe'

Stage 2: `all of selection_img`

or:
Image|endswith: '\EXCEL.EXE'
Image|endswith: '\POWERPNT.EXE'
Image|endswith: '\WINWORD.exe'
OriginalFileName: Excel.exe
OriginalFileName: POWERPNT.EXE
OriginalFileName: WinWord.exe

Stage 3: `all of selection_trusted_location`

or:
CommandLine|contains: '\AppData\Roaming\Microsoft\Templates'
CommandLine|contains: '\AppData\Roaming\Microsoft\Word\Startup\'
CommandLine|contains: '\Microsoft Office\Templates\'
CommandLine|contains: '\Microsoft Office\root\Templates\'

Stage 4: `not 1 of filter_main_dotx`

or:
CommandLine|endswith: .dotx
CommandLine|endswith: .potx
CommandLine|endswith: .xltx

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	ends_with	`.dotx` `.potx` `.xltx`
`CommandLine`	match	`\AppData\Roaming\Microsoft\Templates` `\AppData\Roaming\Microsoft\Word\Startup\` `\Microsoft Office\Templates\` `\Microsoft Office\root\Templates\`
`Image`	ends_with	`\EXCEL.EXE` corpus 2 (sigma 2) `\POWERPNT.EXE` corpus 4 (sigma 4) `\WINWORD.exe` corpus 5 (sigma 5)
`OriginalFileName`	eq	`Excel.exe` corpus 3 (sigma 3) `POWERPNT.EXE` corpus 3 (sigma 3) `WinWord.exe` corpus 4 (sigma 4)
`ParentImage`	ends_with	`\dopus.exe` `\explorer.exe` corpus 11 (sigma 11)

Potentially Suspicious Office Document Executed From Trusted Location

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: all of selection_parent

Stage 2: all of selection_img

Stage 3: all of selection_trusted_location

Stage 4: not 1 of filter_main_dotx

Indicators

Stage 1: `all of selection_parent`

Stage 2: `all of selection_img`

Stage 3: `all of selection_trusted_location`

Stage 4: `not 1 of filter_main_dotx`