Hub configuration

Name: Suspicious Binary In User Directory Spawned From Office Application
Author: sigmahq

More info

Suspicious Binary In User Directory Spawned From Office Application Detection Scenario by sigmahq | CrowdSec Hub

« Suspicious Binary In User Directory Spawned From Office Application »
v0.2 by sigmahq / proc_creation_win_office_spawn_exe_from_users_directory
Attack scenariowindowsNot spoofableLow confidence

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Installation

cscli scenarios install sigmahq/proc_creation_win_office_spawn_exe_from_users_directory

YAML Configuration

1type: trigger
2name: sigmahq/proc_creation_win_office_spawn_exe_from_users_directory
3description: |
4  Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.ParentImage endsWith '\\WINWORD.EXE' || evt.Parsed.ParentImage endsWith '\\EXCEL.EXE' || evt.Parsed.ParentImage endsWith '\\POWERPNT.exe' || evt.Parsed.ParentImage endsWith '\\MSPUB.exe' || evt.Parsed.ParentImage endsWith '\\VISIO.exe' || evt.Parsed.ParentImage endsWith '\\MSACCESS.exe' || evt.Parsed.ParentImage endsWith '\\EQNEDT32.exe') && evt.Parsed.Image startsWith 'C:\\users\\' && evt.Parsed.Image endsWith '.exe' && not (evt.Parsed.Image endsWith '\\Teams.exe'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1204.002
15
16  label: "Suspicious Binary In User Directory Spawned From Office Application"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24

Hub configuration

« Suspicious Binary In User Directory Spawned From Office Application »v0.2 by sigmahq / proc_creation_win_office_spawn_exe_from_users_directoryAttack scenariowindowsNot spoofableLow confidenceMITRE:t1204

« Suspicious Binary In User Directory Spawned From Office Application »
v0.2 by sigmahq / proc_creation_win_office_spawn_exe_from_users_directory
Attack scenariowindowsNot spoofableLow confidence