Query: detection rule: Detects the creation of a file with an uncommon extension in an Office application startup folder
Matching passage: Sigma rule: Detects the creation of a file with an uncommon extension in an Office application startup folder. Logsource: windows / file_event. Rule: title: Uncommon File Created In Office Startup Folder id: a10a2c40-2c4d-49f8-b557-1a946bc55d9d status: test description: Detects the creation of a file with an uncommon extension in an Office application startup folder references: - https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/ - http://addbalance.com/word/startup.htm - https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3 - https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-06-05 modified: 2023-12-13 tags: - attack.resource-development - attack.t1587.001 logsource: product: windows category: file_event detection: selection_word_paths: - TargetFilename|contains: \Microsoft\Word\STARTUP - TargetFilename|contains|all: - \Office - \Program Files - \STARTUP filter_exclude_word_ext: TargetFilename|endswith: - .docb - .docm - .docx - .dotm - .mdb - .mdw - .pdf - .wll - .wwl selection_excel_paths: - TargetFilename|contains: \Microsoft\Excel\XLSTART - TargetFilename|contains|all: - \Office - \Program Files - \XLSTART filter_exclude_excel_ext: TargetFilename|endswith: - .xll - .xls - .xlsm - .xlsx - .xlt - .xltm - .xlw filter_main_office_click_to_run: Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_office_apps: Image|contains: - :\Program Files\Microsoft Office\ - :\Program Files (x86)\Microsoft Office\ Image|endswith: - \winword.exe - \excel.exe condition: ((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_* falsepositives: - False positive might stem from rare extensions used by other Office utilities. level: high
Near-miss passage: Sigma rule: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Created as System id: 590a5f4c-6c8c-4f10-8307-89afe9453a9d status: test description: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://github.com/antonioCoco/RogueWinRM - https://twitter.com/Cyb3rWard0g/status/1453123054243024897 author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR) date: 2019-10-26 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.002 logsource: category: process_creation product: windows definition: 'Requirements: ParentUser field needs sysmon >= 13.30' detection: selection: ParentUser|contains: - AUTHORI - AUTORI ParentUser|endswith: - \NETWORK SERVICE - \LOCAL SERVICE User|contains: - AUTHORI - AUTORI User|endswith: - \SYSTEM - \Système - \СИСТЕМА IntegrityLevel: - System - S-1-16-16384 filter_rundll32: Image|endswith: \rundll32.exe CommandLine|contains: DavSetCookie condition: selection and not 1 of filter_* falsepositives: - Unknown level: high