{"id":"c27515df-97a9-4162-8a60-dc0eeb51b775","title":"Suspicious Microsoft OneNote Child Process","description":"Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.","author":"Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)","status":"test","level":"high","date":"2022-10-21","modified":"2023-02-10","tags":["attack.t1566","attack.t1566.001","attack.initial-access"],"technique_ids":["T1566","T1566.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["File located in the AppData folder with trusted signature"],"references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18","https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0"],"source_path":"rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml","source_sha256":"ac740ae201bb030e4d404591b6163dbf22f5ea7adba1fabac2ffdbbe867bc53e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Microsoft OneNote Child Process\nid: c27515df-97a9-4162-8a60-dc0eeb51b775\nrelated:\n    - id: 438025f9-5856-4663-83f7-52f878a70a50 # Generic rule for suspicious office application child processes\n      type: derived\nstatus: test\ndescription: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.\nreferences:\n    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18\n    - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0\nauthor: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)\ndate: 2022-10-21\nmodified: 2023-02-10\ntags:\n    - attack.t1566\n    - attack.t1566.001\n    - attack.initial-access\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\onenote.exe'\n    selection_opt_img:\n        - OriginalFileName:\n              - 'bitsadmin.exe'\n              - 'CertOC.exe'\n              - 'CertUtil.exe'\n              - 'Cmd.Exe'\n              - 'CMSTP.EXE'\n              - 'cscript.exe'\n              - 'curl.exe'\n              - 'HH.exe'\n              - 'IEExec.exe'\n              - 'InstallUtil.exe'\n              - 'javaw.exe'\n              - 'Microsoft.Workflow.Compiler.exe'\n              - 'msdt.exe'\n              - 'MSHTA.EXE'\n              - 'msiexec.exe'\n              - 'Msxsl.exe'\n              - 'odbcconf.exe'\n              - 'pcalua.exe'\n              - 'PowerShell.EXE'\n              - 'RegAsm.exe'\n              - 'RegSvcs.exe'\n              - 'REGSVR32.exe'\n              - 'RUNDLL32.exe'\n              - 'schtasks.exe'\n              - 'ScriptRunner.exe'\n              - 'wmic.exe'\n              - 'WorkFolders.exe'\n              - 'wscript.exe'\n        - Image|endswith:\n              - '\\AppVLP.exe'\n              - '\\bash.exe'\n              - '\\bitsadmin.exe'\n              - '\\certoc.exe'\n              - '\\certutil.exe'\n              - '\\cmd.exe'\n              - '\\cmstp.exe'\n              - '\\control.exe'\n              - '\\cscript.exe'\n              - '\\curl.exe'\n              - '\\forfiles.exe'\n              - '\\hh.exe'\n              - '\\ieexec.exe'\n              - '\\installutil.exe'\n              - '\\javaw.exe'\n              - '\\mftrace.exe'\n              - '\\Microsoft.Workflow.Compiler.exe'\n              - '\\msbuild.exe'\n              - '\\msdt.exe'\n              - '\\mshta.exe'\n              - '\\msidb.exe'\n              - '\\msiexec.exe'\n              - '\\msxsl.exe'\n              - '\\odbcconf.exe'\n              - '\\pcalua.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\regasm.exe'\n              - '\\regsvcs.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\schtasks.exe'\n              - '\\scrcons.exe'\n              - '\\scriptrunner.exe'\n              - '\\sh.exe'\n              - '\\svchost.exe'\n              - '\\verclsid.exe'\n              - '\\wmic.exe'\n              - '\\workfolders.exe'\n              - '\\wscript.exe'\n    selection_opt_explorer:\n        Image|endswith: '\\explorer.exe'\n        CommandLine|contains:\n            - '.hta'\n            - '.vb'\n            - '.wsh'\n            - '.js'\n            - '.ps'\n            - '.scr'\n            - '.pif'\n            - '.bat'\n            - '.cmd'\n    selection_opt_paths:\n        Image|contains:\n            - '\\AppData\\'\n            - '\\Users\\Public\\'\n            - '\\ProgramData\\'\n            - '\\Windows\\Tasks\\'\n            - '\\Windows\\Temp\\'\n            - '\\Windows\\System32\\Tasks\\'\n    filter_teams:\n        Image|endswith: '\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe'\n        CommandLine|endswith: '-Embedding'\n    filter_onedrive:\n        Image|contains: '\\AppData\\Local\\Microsoft\\OneDrive\\'\n        Image|endswith: '\\FileCoAuth.exe'\n        CommandLine|endswith: '-Embedding'\n    condition: selection_parent and 1 of selection_opt_* and not 1 of filter_*\nfalsepositives:\n    - File located in the AppData folder with trusted signature\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1566","id":"T1566","name":"Phishing","page":"techniques/enterprise/T1566/"},{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","page":"techniques/enterprise/T1566.001/"}],"data_path":"data/detection-rules/c27515df-97a9-4162-8a60-dc0eeb51b775.json","kind":"sigma"}