# Evaluation of Local Security Event Management System vs. Standard Antivirus Software
## 3 Methodology and Implementation
### Implementation and Execution of Experimental Tests
A general approach of the proposed methodology for data collection and analysis can be understood following the graph of events shown in Figure 3. This example corresponds to the execution of a Microsoft Word document that has embedded a macro (VBA) [76] with malicious code, that is Code I in the set of tests. The graph of events shown in Figure 3, includes all the important events triggered by the execution of Code I. Therefore, the execution process can be described as follows:  
1. The user receives compressed file and proceeds to download it to the system. 2. Launches WinRAR application to obtain the contents of the file. 3. The result of the decompression is the file \"**test2.doc**\" (\"prueba2.doc\" in the graph) which contains the macro with malicious code embedded in it. 4. It is executed by the user and the system calls the WINWORD.exe program to open the document. 5. When the user enables the execution of the macros an error occurs in the WINWORD.exe binary that calls DW20.exe, which is responsible for compiling an error report. 6. While the previous step occurs, the macro execution occurs which launches a command console on the system. The mapping of the steps discussed above onto MITRE ATT&CK, and the Cyber Kill Chain are the following:  
* The step 1 corresponds to the MITRE ATT&CK tactic \"**Initial Access**\" and technique \"**T1566-Phishing**\" and \"**Delivery**\" action in the Cyber Kill Chain. Figure 3: Result of malicious macro execution in a Microsoft Word document. * The step 2 corresponds to the MITRE ATT&CK tactic \"**Execution**\" and technique \"**T1204-User Execution**\" and \"**Exploitation**\" action in the Cyber Kill Chain. * The step 3 corresponds to the MITRE ATT&CK tactic \"**Persistence**\" and technique \"**T1137-Office Application Startup**\" and \"**Installation**\" action in the Cyber Kill Chain. * The step 4 corresponds to the MITRE ATT&CK tactic \"**Defense Evasion**\" and technique \"**T1055-Process Injection**\" and \"**Installation**\" action in the Cyber Kill Chain. * The steps 5 and 6 corresponds to the MITRE ATT&CK tactic \"**Execution**\" and technique \"**T1059-Command-Line Interface**\" and \"**Installation**\" action in the Cyber Kill Chain. In this example, the system detects several events that are matched to MITRE ATT&CK and Cyber Kill Chain, but most of them are low or medium risk. Technique \"**T1204**\" in steps 2 and 3 is part of the \"**Execution**\" tactic, but it is not considered high-risk, because it means that the user launched the execution of a program such as Word. Similarly, in step 4 the system captures a \"**Defense Evasion**\" tactic because of technique \"**T1055**\" which is neither a high-risk technique because it involves the execution of Dynamic Linked Libraries (DLLs), like almost all windows programs. Conversely, the latest event, also corresponding to the \"**Execution**\" tactic, is the one that actually triggers the alarm. Technique \"**T1059**\" is defined as type high-risk, because it means that the macro is launching a Command Tool or Power Shell for executing any kind of commands. One of the features of Microsoft Word, is the ability to create multiple letters automatically out of a list of names and addresses stored in a database. This feature is called Mail Merge and can be used in conjunction with Open Database Connectivity (ODBC) to connect Word with a database server. It could be very useful to include a macro in that type of documents to verify, using a ping command, if there is connectivity with the database server before attempting to generate mail letters. Upon opening such document, the system will not trigger any alarm, because it contains a benign macro. The sequence of event will be very similar than before, but instead of technique \"**T1059**\" at the latest step, the system will be getting \"**T1018**\" (associated with ping command), which is a low-risk Discovery tactic that does not trigger the alarm.