Office Macro File Creation From Suspicious Process

Title: Office Macro File Creation From Suspicious Process
Status: test
Description:Detects the creation of a office macro file from a a suspicious process
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  -https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-23
modified:2023-02-22
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'

Logsource:

• category: file_event
• product: windows
• definition: Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data

Detection:
  selection_cmd:
    - Image|endswith:
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
    - ParentImage|endswith:
      - '\cscript.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
  selection_ext:
    TargetFilename|endswith:
      -'.docm'
      -'.dotm'
      -'.xlsm'
      -'.xltm'
      -'.potm'
      -'.pptm'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high