detection.wiki

Detection rules › Splunk

Windows Office Product Dropped Uncommon File

Author
Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github
Source
upstream

The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as ".exe", ".dll", or ".ps1". This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1566.001 Phishing: Spearphishing Attachment

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE (Processes.original_file_name IN ("EQNEDT32.EXE", "Excel.exe", "Graph.exe", "MSACCESS.EXE", "MSPUB.EXE", "OUTLOOK.EXE", "OneNote.exe", "OneNoteIm.exe", "OneNoteM.exe", "POWERPNT.EXE", "VISIO.EXE", "WinProj.exe", "WinWord.exe") OR Processes.process_name IN ("EQNEDT32.exe", "Graph.exe", "excel.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe")) BY _time, Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: join

join type=inner (...)

Stage 4: dedup

dedup file_create_time

Stage 5: table

table dest, file_create_time, file_name, file_path, process, process_guid, process_name

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_namein
  • "*.dll" corpus 6 (splunk 6)
  • "*.exe" corpus 7 (splunk 7)
  • "*.js" corpus 5 (splunk 5)
  • "*.pif" corpus 5 (splunk 5)
  • "*.ps1" corpus 3 (splunk 3)
  • "*.scr"
  • "*.vbe" corpus 5 (splunk 5)
  • "*.vbs" corpus 5 (splunk 5)
Processes.original_file_namein
  • "EQNEDT32.EXE" corpus 2 (splunk 2)
  • "Excel.exe" corpus 2 (splunk 2)
  • "Graph.exe" corpus 2 (splunk 2)
  • "MSACCESS.EXE" corpus 2 (splunk 2)
  • "MSPUB.EXE" corpus 2 (splunk 2)
  • "OUTLOOK.EXE" corpus 2 (splunk 2)
  • "OneNote.exe" corpus 2 (splunk 2)
  • "OneNoteIm.exe" corpus 2 (splunk 2)
  • "OneNoteM.exe" corpus 2 (splunk 2)
  • "POWERPNT.EXE" corpus 2 (splunk 2)
  • "VISIO.EXE" corpus 2 (splunk 2)
  • "WinProj.exe" corpus 2 (splunk 2)
  • "WinWord.exe" corpus 2 (splunk 2)
Processes.process_namein
  • "EQNEDT32.exe" corpus 5 (splunk 5)
  • "Graph.exe" corpus 5 (splunk 5)
  • "excel.exe" corpus 5 (splunk 5)
  • "msaccess.exe" corpus 5 (splunk 5)
  • "mspub.exe" corpus 5 (splunk 5)
  • "onenote.exe" corpus 5 (splunk 5)
  • "onenoteim.exe" corpus 5 (splunk 5)
  • "onenotem.exe" corpus 5 (splunk 5)
  • "outlook.exe" corpus 5 (splunk 5)
  • "powerpnt.exe" corpus 5 (splunk 5)
  • "visio.exe" corpus 5 (splunk 5)
  • "winproj.exe" corpus 5 (splunk 5)
  • "winword.exe" corpus 5 (splunk 5)
  • "wordpad.exe" corpus 3 (splunk 3)
  • "wordview.exe" corpus 3 (splunk 3)