{"id":"e6ce8457-68b1-485b-9bdd-3c2b5d679aa9","title":"VBA DLL Loaded Via Office Application","description":"Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.","author":"Antonlovesdnb","status":"test","level":"high","date":"2020-02-19","modified":"2023-02-10","tags":["attack.execution","attack.t1204.002"],"technique_ids":["T1204.002"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Legitimate macro usage. Add the appropriate filter according to your environment"],"references":["https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16"],"source_path":"rules/windows/image_load/image_load_office_vbadll_load.yml","source_sha256":"3d9d836a832bd810ce5b666f88275438684b4315925890869e1637fc433481f5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_office_vbadll_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: VBA DLL Loaded Via Office Application\nid: e6ce8457-68b1-485b-9bdd-3c2b5d679aa9\nstatus: test\ndescription: Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.\nreferences:\n    - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16\nauthor: Antonlovesdnb\ndate: 2020-02-19\nmodified: 2023-02-10\ntags:\n    - attack.execution\n    - attack.t1204.002\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\excel.exe'\n            - '\\mspub.exe'\n            - '\\onenote.exe'\n            - '\\onenoteim.exe' # Just in case\n            - '\\outlook.exe'\n            - '\\powerpnt.exe'\n            - '\\winword.exe'\n        ImageLoaded|endswith:\n            - '\\VBE7.DLL'\n            - '\\VBEUI.DLL'\n            - '\\VBE7INTL.DLL'\n    condition: selection\nfalsepositives:\n    - Legitimate macro usage. Add the appropriate filter according to your environment\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"}],"data_path":"data/detection-rules/e6ce8457-68b1-485b-9bdd-3c2b5d679aa9.json","kind":"sigma"}