Query: detection rule: Detects potential arbitrary file download using a Microsoft Office application
Matching passage: Sigma rule: Detects potential arbitrary file download using a Microsoft Office application. Logsource: windows / process_creation. Rule: title: Potential Arbitrary File Download Using Office Application id: 4ae3e30b-b03f-43aa-87e3-b622f4048eed related: - id: 0c79148b-118e-472b-bdb7-9b57b444cc19 type: obsolete status: test description: Detects potential arbitrary file download using a Microsoft Office application references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/ - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191 author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community date: 2022-05-17 modified: 2023-06-22 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \EXCEL.EXE - \POWERPNT.EXE - \WINWORD.exe - OriginalFileName: - Excel.exe - POWERPNT.EXE - WinWord.exe selection_http: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious user agent strings used by malware in proxy logs. Logsource: proxy. Rule: title: Malware User Agent id: 5c84856b-55a5-45f1-826f-13f37250cf4e status: test description: Detects suspicious user agent strings used by malware in proxy logs references: - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules - http://www.botopedia.org/search?searchword=scan&searchphrase=all - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html - https://perishablepress.com/blacklist/ua-2013.txt - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents - https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q - https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large - https://twitter.com/crep1x/status/1635034100213112833 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2017-07-08 modified: 2024-04-14 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0 - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) - HttpBrowser/1.0 - '*<|>*' - nsis_inetc (mozilla) - Wget/1.9+cvs-stable (Red Hat modified) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) - '*zeroup*' - Mozilla/5.0 (Windows NT 5.1 ; v.* - '* adlib/*' - '* tiny' - '* BGroom *' - '* changhuatong' - '* CholTBAgent' - Mozilla/5.0 WinInet - RookIE/1.0 - M - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) - backdoorbot - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) - Opera/8.81 (Windows NT 6.0; U; en) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729) - Opera - Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) - MSIE - '*(Charon; Inferno)' - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/5.0 (Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64) - Mozilla/4.0