Uncommon File Created In Office Startup Folder

Title: Uncommon File Created In Office Startup Folder
Status: test
Description:Detects the creation of a file with an uncommon extension in an Office application startup folder
References:
  -https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/
  -http://addbalance.com/word/startup.htm
  -https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3
  -https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-05
modified:2023-12-13
Tags:

• -'attack.resource-development'
• -'attack.t1587.001'

Logsource:

• product: windows
• category: file_event

Detection:
  selection_word_paths:
TargetFilename|contains:'\Microsoft\Word\STARTUP'     - TargetFilename|contains|all:
      - '\Office'
      - '\Program Files'
      - '\STARTUP'
  filter_exclude_word_ext:
    TargetFilename|endswith:
      -'.docb'
      -'.docm'
      -'.docx'
      -'.dotm'
      -'.mdb'
      -'.mdw'
      -'.pdf'
      -'.wll'
      -'.wwl'

  selection_excel_paths:
TargetFilename|contains:'\Microsoft\Excel\XLSTART'     - TargetFilename|contains|all:
      - '\Office'
      - '\Program Files'
      - '\XLSTART'
  filter_exclude_excel_ext:
    TargetFilename|endswith:
      -'.xll'
      -'.xls'
      -'.xlsm'
      -'.xlsx'
      -'.xlt'
      -'.xltm'
      -'.xlw'

  filter_main_office_click_to_run:
    Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
    Image|endswith: '\OfficeClickToRun.exe'
  filter_main_office_apps:
    Image|contains:
      -':\Program Files\Microsoft Office\'
      -':\Program Files (x86)\Microsoft Office\'

    Image|endswith:
      -'\winword.exe'
      -'\excel.exe'

  condition:((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_*
Falsepositives:
  -False positive might stem from rare extensions used by other Office utilities.
Level: high