{"id":"b1c50487-1967-4315-a026-6491686d860e","title":"Office Macro File Creation From Suspicious Process","description":"Detects the creation of a office macro file from a a suspicious process","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-01-23","modified":"2023-02-22","tags":["attack.initial-access","attack.t1566.001"],"technique_ids":["T1566.001"],"logsource":{"category":"file_event","product":"windows","definition":"Requirements: The \"ParentImage\" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md","https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference"],"source_path":"rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml","source_sha256":"eaeb0dc4e5064faecfbb1632c6c59f125c2987fb25f8c8193ff8ed0c2c920b39","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Office Macro File Creation From Suspicious Process\nid: b1c50487-1967-4315-a026-6491686d860e\nstatus: test\ndescription: Detects the creation of a office macro file from a a suspicious process\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md\n    - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-01-23\nmodified: 2023-02-22\ntags:\n    - attack.initial-access\n    - attack.t1566.001\nlogsource:\n    category: file_event\n    product: windows\n    definition: 'Requirements: The \"ParentImage\" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data'\ndetection:\n    selection_cmd:\n        - Image|endswith:\n              - '\\cscript.exe'\n              - '\\mshta.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\wscript.exe'\n        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11\n        - ParentImage|endswith:\n              - '\\cscript.exe'\n              - '\\mshta.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\wscript.exe'\n    selection_ext:\n        TargetFilename|endswith:\n            - '.docm'\n            - '.dotm'\n            - '.xlsm'\n            - '.xltm'\n            - '.potm'\n            - '.pptm'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","page":"techniques/enterprise/T1566.001/"}],"data_path":"data/detection-rules/b1c50487-1967-4315-a026-6491686d860e.json","kind":"sigma"}