{"id":"69483748-1525-4a6c-95ca-90dc8d431b68","title":"Suspicious Microsoft Office Child Process - MacOS","description":"Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution","author":"Sohan G (D4rkCiph3r)","status":"test","level":"high","date":"2023-01-31","modified":"2023-02-04","tags":["attack.execution","attack.persistence","attack.t1059.002","attack.t1137.002","attack.t1204.002"],"technique_ids":["T1059.002","T1137.002","T1204.002"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://redcanary.com/blog/applescript/","https://objective-see.org/blog/blog_0x4B.html"],"source_path":"rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml","source_sha256":"6c705380877749aadda1ddd9f76b2471754565d9fd95ca428494cbf43909e72a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Microsoft Office Child Process - MacOS\nid: 69483748-1525-4a6c-95ca-90dc8d431b68\nstatus: test\ndescription: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution\nreferences:\n    - https://redcanary.com/blog/applescript/\n    - https://objective-see.org/blog/blog_0x4B.html\nauthor: Sohan G (D4rkCiph3r)\ndate: 2023-01-31\nmodified: 2023-02-04\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.t1059.002\n    - attack.t1137.002\n    - attack.t1204.002\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        ParentImage|contains:\n            - 'Microsoft Word'\n            - 'Microsoft Excel'\n            - 'Microsoft PowerPoint'\n            - 'Microsoft OneNote'\n        Image|endswith:\n            - '/bash'\n            - '/curl'\n            - '/dash'\n            - '/fish'\n            - '/osacompile'\n            - '/osascript'\n            - '/sh'\n            - '/zsh'\n            - '/python'\n            - '/python3'\n            - '/wget'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.002","id":"T1059.002","name":"AppleScript","page":"techniques/enterprise/T1059.002/"},{"key":"enterprise/T1137.002","id":"T1137.002","name":"Office Test","page":"techniques/enterprise/T1137.002/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"}],"data_path":"data/detection-rules/69483748-1525-4a6c-95ca-90dc8d431b68.json","kind":"sigma"}