Query: rule covering Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, P
Matching passage: Sigma rule: Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, P. Logsource: windows / process_creation. Rule: title: Suspicious Binary In User Directory Spawned From Office Application id: aa3a6f94-890e-4e22-b634-ffdfd54792cc status: test description: Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio) references: - https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign - https://www.virustotal.com/gui/file/23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57 author: Jason Lynch date: 2019-04-02 modified: 2023-02-04 tags: - attack.execution - attack.t1204.002 - attack.g0046 - car.2013-05-002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.exe - \MSPUB.exe - \VISIO.exe - \MSACCESS.exe - \EQNEDT32.exe Image|startswith: C:\users\ Image|endswith: .exe filter: Image|endswith: \Teams.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of files with an executable or script extension by an Office application.. Logsource: windows / file_event. Rule: title: File With Uncommon Extension Created By An Office Application id: c7a74c80-ba5a-486e-9974-ab9e682bc5e4 status: test description: Detects the creation of files with an executable or script extension by an Office application. references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems) date: 2021-08-23 modified: 2025-10-17 tags: - attack.t1204.002 - attack.execution logsource: product: windows category: file_event detection: selection1: Image|endswith: - \excel.exe - \msaccess.exe - \mspub.exe - \powerpnt.exe - \visio.exe - \winword.exe selection2: TargetFilename|endswith: - .bat - .cmd - .com - .dll - .exe - .hta - .ocx - .proj - .ps1 - .scf - .scr - .sys - .vbe - .vbs - .wsf - .wsh filter_main_localassembly: TargetFilename|contains: \AppData\Local\assembly\tmp\ TargetFilename|endswith: .dll filter_optional_webservicecache: TargetFilename|contains|all: - C:\Users\ - \AppData\Local\Microsoft\Office\ - \WebServiceCache\AllUsers TargetFilename|endswith: .com filter_optional_webex: Image|endswith: \winword.exe TargetFilename|contains: \AppData\Local\Temp\webexdelta\ TargetFilename|endswith: - .dll - .exe filter_optional_backstageinappnavcache: TargetFilename|contains|all: - C:\Users\ - \AppData\Local\Microsoft\Office\ - \BackstageInAppNavCache\ TargetFilename|endswith: .com condition: all of selection* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high