Query: Sigma rule for Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publishe
Matching passage: Sigma rule: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publishe. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft Office Child Process id: 438025f9-5856-4663-83f7-52f878a70a50 related: - id: c27515df-97a9-4162-8a60-dc0eeb51b775 type: derived - id: e1693bc8-7168-4eab-8718-cdcaa68a1738 type: derived - id: 23daeb52-e6eb-493c-8607-c4f0246cb7d8 type: obsolete - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.) references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml - https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A - https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml - https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html - https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/ author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io date: 2018-04-06 modified: 2023-04-24 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \EQNEDT32.EXE - \EXCEL.EXE - \MSACCESS.EXE - \MSPUB.exe - \ONENOTE.EXE - \POWERPNT.exe - \VISIO.exe - \WINWORD.EXE - \wordpad.exe - \wordview.exe selection_child_processes: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe -
Near-miss passage: Sigma rule: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases. Logsource: windows / process_creation. Rule: title: Usage Of Web Request Commands And Cmdlets id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d related: - id: 1139d2e2-84b1-4226-b445-354492eba8ba type: similar - id: f67dbfce-93bc-440d-86ad-a95ae8858c90 type: obsolete - id: cd5c8085-4070-4e22-908d-a5b3342deb74 type: obsolete - id: 6e897651-f157-4d8f-aaeb-df8151488385 type: obsolete status: test description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine references: - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/ - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell - https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger date: 2019-10-24 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '[System.Net.WebRequest]::create' - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - Resume-BitsTransfer - Start-BitsTransfer - 'wget ' - WinHttp.WinHttpRequest condition: selection falsepositives: - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer. level: medium