{"id":"a10a2c40-2c4d-49f8-b557-1a946bc55d9d","title":"Uncommon File Created In Office Startup Folder","description":"Detects the creation of a file with an uncommon extension in an Office application startup folder","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-05","modified":"2023-12-13","tags":["attack.resource-development","attack.t1587.001"],"technique_ids":["T1587.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["False positive might stem from rare extensions used by other Office utilities."],"references":["https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/","http://addbalance.com/word/startup.htm","https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3","https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions"],"source_path":"rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml","source_sha256":"6188b8aba79a8911505daacb5d1b4923f175e68ddbaf8e642bba4e7feadca116","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon File Created In Office Startup Folder\nid: a10a2c40-2c4d-49f8-b557-1a946bc55d9d\nstatus: test\ndescription: Detects the creation of a file with an uncommon extension in an Office application startup folder\nreferences:\n    - https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/\n    - http://addbalance.com/word/startup.htm\n    - https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3\n    - https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-06-05\nmodified: 2023-12-13\ntags:\n    - attack.resource-development\n    - attack.t1587.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection_word_paths:\n        - TargetFilename|contains: '\\Microsoft\\Word\\STARTUP'\n        - TargetFilename|contains|all:\n              - '\\Office'\n              - '\\Program Files'\n              - '\\STARTUP'\n    filter_exclude_word_ext:\n        TargetFilename|endswith:\n            - '.docb' # Word binary document introduced in Microsoft Office 2007\n            - '.docm' # Word macro-enabled document; same as docx, but may contain macros and scripts\n            - '.docx' # Word document\n            - '.dotm' # Word macro-enabled template; same as dotx, but may contain macros and scripts\n            - '.mdb' # MS Access DB\n            - '.mdw' # MS Access DB\n            - '.pdf' # PDF documents\n            - '.wll' # Word add-in\n            - '.wwl' # Word add-in\n    selection_excel_paths:\n        - TargetFilename|contains: '\\Microsoft\\Excel\\XLSTART'\n        - TargetFilename|contains|all:\n              - '\\Office'\n              - '\\Program Files'\n              - '\\XLSTART'\n    filter_exclude_excel_ext:\n        TargetFilename|endswith:\n            - '.xll'\n            - '.xls'\n            - '.xlsm'\n            - '.xlsx'\n            - '.xlt'\n            - '.xltm'\n            - '.xlw'\n    filter_main_office_click_to_run:\n        Image|contains: ':\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\'\n        Image|endswith: '\\OfficeClickToRun.exe'\n    filter_main_office_apps:\n        Image|contains:\n            - ':\\Program Files\\Microsoft Office\\'\n            - ':\\Program Files (x86)\\Microsoft Office\\'\n        Image|endswith:\n            - '\\winword.exe'\n            - '\\excel.exe'\n    condition: ((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_*\nfalsepositives:\n    - False positive might stem from rare extensions used by other Office utilities.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1587.001","id":"T1587.001","name":"Malware","page":"techniques/enterprise/T1587.001/"}],"data_path":"data/detection-rules/a10a2c40-2c4d-49f8-b557-1a946bc55d9d.json","kind":"sigma"}