{"id":"438025f9-5856-4663-83f7-52f878a70a50","title":"Suspicious Microsoft Office Child Process","description":"Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)","author":"Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io","status":"test","level":"high","date":"2018-04-06","modified":"2023-04-24","tags":["attack.execution","attack.stealth","attack.t1047","attack.t1204.002","attack.t1218.010"],"technique_ids":["T1047","T1204.002","T1218.010"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100","https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html","https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e","https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml","https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml","https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A","https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set","https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml","https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html","https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/"],"source_path":"rules/windows/process_creation/proc_creation_win_office_susp_child_processes.yml","source_sha256":"346e43a68093c87fc0350a1021fd8b22887e928bf6dd9c9caa72ffd37521fca9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_susp_child_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Microsoft Office Child Process\nid: 438025f9-5856-4663-83f7-52f878a70a50\nrelated:\n    - id: c27515df-97a9-4162-8a60-dc0eeb51b775 # Speicifc OneNote rule due to its recent usage in phishing attacks\n      type: derived\n    - id: e1693bc8-7168-4eab-8718-cdcaa68a1738\n      type: derived\n    - id: 23daeb52-e6eb-493c-8607-c4f0246cb7d8\n      type: obsolete\n    - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a\n      type: obsolete\n    - id: 04f5363a-6bca-42ff-be70-0d28bf629ead\n      type: obsolete\nstatus: test\ndescription: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)\nreferences:\n    - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100\n    - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html\n    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n    - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e\n    - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\n    - https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml\n    - https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A\n    - https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set\n    - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml\n    - https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html\n    - https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/\nauthor: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io\ndate: 2018-04-06\nmodified: 2023-04-24\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1047\n    - attack.t1204.002\n    - attack.t1218.010\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith:\n            - '\\EQNEDT32.EXE'\n            - '\\EXCEL.EXE'\n            - '\\MSACCESS.EXE'\n            - '\\MSPUB.exe'\n            - '\\ONENOTE.EXE'\n            - '\\POWERPNT.exe'\n            - '\\VISIO.exe'\n            - '\\WINWORD.EXE'\n            - '\\wordpad.exe'\n            - '\\wordview.exe'\n    selection_child_processes:\n        - OriginalFileName:\n              - 'bitsadmin.exe'\n              - 'CertOC.exe'\n              - 'CertUtil.exe'\n              - 'Cmd.Exe'\n              - 'CMSTP.EXE'\n              - 'cscript.exe'\n              - 'curl.exe'\n              - 'HH.exe'\n              - 'IEExec.exe'\n              - 'InstallUtil.exe'\n              - 'javaw.exe'\n              - 'Microsoft.Workflow.Compiler.exe'\n              - 'msdt.exe'\n              - 'MSHTA.EXE'\n              - 'msiexec.exe'\n              - 'Msxsl.exe'\n              - 'odbcconf.exe'\n              - 'pcalua.exe'\n              - 'PowerShell.EXE'\n              - 'RegAsm.exe'\n              - 'RegSvcs.exe'\n              - 'REGSVR32.exe'\n              - 'RUNDLL32.exe'\n              - 'schtasks.exe'\n              - 'ScriptRunner.exe'\n              - 'wmic.exe'\n              - 'WorkFolders.exe'\n              - 'wscript.exe'\n        - Image|endswith:\n              - '\\AppVLP.exe'\n              - '\\bash.exe'\n              - '\\bitsadmin.exe'\n              - '\\certoc.exe'\n              - '\\certutil.exe'\n              - '\\cmd.exe'\n              - '\\cmstp.exe'\n              - '\\control.exe'\n              - '\\cscript.exe'\n              - '\\curl.exe'\n              - '\\forfiles.exe'\n              - '\\hh.exe'\n              - '\\ieexec.exe'\n              - '\\installutil.exe'\n              - '\\javaw.exe'\n              - '\\mftrace.exe'\n              - '\\Microsoft.Workflow.Compiler.exe'\n              - '\\msbuild.exe'\n              - '\\msdt.exe'\n              - '\\mshta.exe'\n              - '\\msidb.exe'\n              - '\\msiexec.exe'\n              - '\\msxsl.exe'\n              - '\\odbcconf.exe'\n              - '\\pcalua.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\regasm.exe'\n              - '\\regsvcs.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\schtasks.exe'\n              - '\\scrcons.exe'\n              - '\\scriptrunner.exe'\n              - '\\sh.exe'\n              - '\\svchost.exe'\n              - '\\verclsid.exe'\n              - '\\wmic.exe'\n              - '\\workfolders.exe'\n              - '\\wscript.exe'\n    selection_child_susp_paths: # Idea: Laiali Kazalbach, Mohamed Elsayed (#4142)\n        Image|contains:\n            - '\\AppData\\'\n            - '\\Users\\Public\\'\n            - '\\ProgramData\\'\n            - '\\Windows\\Tasks\\'\n            - '\\Windows\\Temp\\'\n            - '\\Windows\\System32\\Tasks\\'\n    condition: selection_parent and 1 of selection_child_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"},{"key":"enterprise/T1218.010","id":"T1218.010","name":"Regsvr32","page":"techniques/enterprise/T1218.010/"}],"data_path":"data/detection-rules/438025f9-5856-4663-83f7-52f878a70a50.json","kind":"sigma"}