Office Macro File Creation

Title: Office Macro File Creation
Status: test
Description:Detects the creation of a new office macro files on the systems
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  -https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-23
modified:2026-01-09
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    TargetFilename|endswith:
      -'.docm'
      -'.dotm'
      -'.xlsm'
      -'.xltm'
      -'.potm'
      -'.pptm'

  filter_main_office:
    Image|startswith:
      -'C:\Program Files\Microsoft Office\'
      -'C:\Program Files (x86)\Microsoft Office\'

    Image|endswith:
      -'\WINWORD.EXE'
      -'\EXCEL.EXE'
      -'\POWERPNT.EXE'

    TargetFilename|contains: '\~$'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Very common in environments that rely heavily on macro documents
Level: low