Query: Sigma rule for Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg"
Matching passage: Sigma rule: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg". Logsource: windows / file_event. Rule: title: Suspicious File Created Via OneNote Application id: fcc6d700-68d9-4241-9a1a-06874d621b06 status: test description: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/MaD_c4t/status/1623414582382567424 - https://labs.withsecure.com/publications/detecting-onenote-abuse - https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/ - https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-09 modified: 2023-02-27 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: - \onenote.exe - \onenotem.exe - \onenoteim.exe TargetFilename|contains: \AppData\Local\Temp\OneNote\ TargetFilename|endswith: - .bat - .chm - .cmd - .dll - .exe - .hta - .htm - .html - .js - .lnk - .ps1 - .vbe - .vbs - .wsf condition: selection falsepositives: - False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote. - Occasional FPs might occur if OneNote is used internally to share different embedded documents level: high
Near-miss passage: Sigma rule: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution. Logsource: windows / registry_set. Rule: title: Usage of Renamed Sysinternals Tools - RegistrySet id: 8023f872-3f1d-4301-a384-801889917ab4 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: f50f3c09-557d-492d-81db-9064a8d4e211 type: similar status: test description: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \PsExec - \ProcDump - \Handle - \LiveKd - \Process Explorer - \PsLoglist - \PsPasswd - \Active Directory Explorer TargetObject|endswith: \EulaAccepted filter_main_image_names: Image|endswith: - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely level: high