{"id":"551d9c1f-816c-445b-a7a6-7a3864720d60","title":"Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp","description":"Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the \"ActivateMicrosoftApp\" Excel DCOM object.\n","author":"Aaron Stratton","status":"test","level":"high","date":"2023-11-13","modified":"","tags":["attack.t1021.003","attack.lateral-movement"],"technique_ids":["T1021.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922","https://github.com/grayhatkiller/SharpExShell","https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication"],"source_path":"rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml","source_sha256":"2bef8500cbf1f44ecbcfd46c95b092165c3aa09e7c93002b85393d14e35ee56a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp\nid: 551d9c1f-816c-445b-a7a6-7a3864720d60\nstatus: test\ndescription: |\n    Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the \"ActivateMicrosoftApp\" Excel DCOM object.\nreferences:\n    - https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922\n    - https://github.com/grayhatkiller/SharpExShell\n    - https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication\nauthor: Aaron Stratton\ndate: 2023-11-13\ntags:\n    - attack.t1021.003\n    - attack.lateral-movement\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\excel.exe'\n    selection_child:\n        - OriginalFileName:\n          - 'foxprow.exe'\n          - 'schdplus.exe'\n          - 'winproj.exe'\n        - Image|endswith:\n          - '\\foxprow.exe'\n          - '\\schdplus.exe'\n          - '\\winproj.exe'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.003","id":"T1021.003","name":"Distributed Component Object Model","page":"techniques/enterprise/T1021.003/"}],"data_path":"data/detection-rules/551d9c1f-816c-445b-a7a6-7a3864720d60.json","kind":"sigma"}