Home/CVE-2002-0862/Sigma rules
Sigma

Sigma rules for CVE-2002-0862

67 rules · scoped to cve · back to CVE-2002-0862
Direct rules mention this entity in their title or description. Related rules cover the techniques this entity is known to use.
◈

Detection rules

17 of 67
direct high
Renamed Office Binary Execution
Detects the execution of a renamed office binary
status test author Nasreddine Bencherchali (Nextron Systems) id 0b0cd537-fc77-4e6e-a973-e53495c1083d license Sigma · DRL-1.1
view Sigma YAML 
title: Renamed Office Binary Execution
id: 0b0cd537-fc77-4e6e-a973-e53495c1083d
status: test
description: Detects the execution of a renamed office binary
references:
    - https://infosec.exchange/@sbousseaden/109542254124022664
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-20
modified: 2025-12-09
tags:
    - attack.stealth
    - attack.t1036.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName:
              - 'Excel.exe'
              - 'MSACCESS.EXE'
              - 'MSPUB.EXE'
              - 'OneNote.exe'
              - 'OneNoteM.exe'
              - 'OUTLOOK.EXE'
              - 'POWERPNT.EXE'
              - 'WinWord.exe'
              - 'Olk.exe'
        - Description:
              - 'Microsoft Access'
              - 'Microsoft Excel'
              - 'Microsoft OneNote'
              - 'Microsoft Outlook'
              - 'Microsoft PowerPoint'
              - 'Microsoft Publisher'
              - 'Microsoft Word'
              - 'Sent to OneNote Tool'
    filter_main_legit_names:
        Image|endswith:
            - '\EXCEL.exe'
            - '\excelcnv.exe'
            - '\MSACCESS.exe'
            - '\MSPUB.EXE'
            - '\ONENOTE.EXE'
            - '\ONENOTEM.EXE'
            - '\OUTLOOK.EXE'
            - '\POWERPNT.EXE'
            - '\WINWORD.exe'
            - '\OLK.EXE'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high
direct high
Microsoft Office DLL Sideload
Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
status test author Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) id 829a3bdf-34da-4051-9cf4-8ed221a8ae4f license Sigma · DRL-1.1
view Sigma YAML 
title: Microsoft Office DLL Sideload
id: 829a3bdf-34da-4051-9cf4-8ed221a8ae4f
status: test
description: Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
references:
    - https://hijacklibs.net/ # For list of DLLs that could be sideloaded (search for dlls mentioned here in there)
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
date: 2022-08-17
modified: 2023-03-15
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\outllib.dll'
    filter:
        ImageLoaded|startswith:
            - 'C:\Program Files\Microsoft Office\OFFICE'
            - 'C:\Program Files (x86)\Microsoft Office\OFFICE'
            - 'C:\Program Files\Microsoft Office\Root\OFFICE'
            - 'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high
direct high
VBA DLL Loaded Via Office Application
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
status test author Antonlovesdnb id e6ce8457-68b1-485b-9bdd-3c2b5d679aa9 license Sigma · DRL-1.1
view Sigma YAML 
title: VBA DLL Loaded Via Office Application
id: e6ce8457-68b1-485b-9bdd-3c2b5d679aa9
status: test
description: Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
references:
    - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
author: Antonlovesdnb
date: 2020-02-19
modified: 2023-02-10
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith:
            - '\excel.exe'
            - '\mspub.exe'
            - '\onenote.exe'
            - '\onenoteim.exe' # Just in case
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\winword.exe'
        ImageLoaded|endswith:
            - '\VBE7.DLL'
            - '\VBEUI.DLL'
            - '\VBE7INTL.DLL'
    condition: selection
falsepositives:
    - Legitimate macro usage. Add the appropriate filter according to your environment
level: high
direct high
GAC DLL Loaded Via Office Applications
Detects any GAC DLL being loaded by an Office Product
status test author Antonlovesdnb id 90217a70-13fc-48e4-b3db-0d836c5824ac license Sigma · DRL-1.1
view Sigma YAML 
title: GAC DLL Loaded Via Office Applications
id: 90217a70-13fc-48e4-b3db-0d836c5824ac
status: test
description: Detects any GAC DLL being loaded by an Office Product
references:
    - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
author: Antonlovesdnb
date: 2020-02-19
modified: 2023-02-10
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith:
            - '\excel.exe'
            - '\mspub.exe'
            - '\onenote.exe'
            - '\onenoteim.exe' # Just in case
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\winword.exe'
        ImageLoaded|startswith: 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL'
    condition: selection
falsepositives:
    - Legitimate macro usage. Add the appropriate filter according to your environment
level: high
direct high
Office Macros Warning Disabled
Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
status test author Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) id 91239011-fe3c-4b54-9f24-15c86bb65913 license Sigma · DRL-1.1
view Sigma YAML 
title: Office Macros Warning Disabled
id: 91239011-fe3c-4b54-9f24-15c86bb65913
related:
    - id: 9b894e57-033f-46cf-b7fa-a52804181973
      type: obsolete
status: test
description: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.
references:
    - https://twitter.com/inversecos/status/1494174785621819397
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
    - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
date: 2020-05-22
modified: 2024-03-19
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Security\VBAWarnings'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unlikely
level: high
direct high
Microsoft Office Protected View Disabled
Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
status test author frack113, Nasreddine Bencherchali (Nextron Systems) id a5c7a43f-6009-4a8c-80c5-32abf1c53ecc license Sigma · DRL-1.1
view Sigma YAML 
title: Microsoft Office Protected View Disabled
id: a5c7a43f-6009-4a8c-80c5-32abf1c53ecc
related:
    - id: 7c637634-c95d-4bbf-b26c-a82510874b34
      type: obsolete
status: test
description: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
    - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
    - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/
    - https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2021-06-08
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: registry_set
detection:
    selection_path:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Office\'
            - '\Security\ProtectedView\'
    selection_values_1:
        Details: 'DWORD (0x00000001)'
        TargetObject|endswith:
            - '\DisableAttachementsInPV' # Turn off Protected View for attachments opened from Outlook
            - '\DisableInternetFilesInPV' # Turn off Protected View for files downloaded from Internet zone
            - '\DisableIntranetCheck' # Turn off Protected View for file located in UNC paths
            - '\DisableUnsafeLocationsInPV' # Turn off Protected View for unsafe locations
    selection_values_0:
        Details: 'DWORD (0x00000000)'
        TargetObject|endswith:
            - '\enabledatabasefileprotectedview'
            - '\enableforeigntextfileprotectedview'
    condition: selection_path and 1 of selection_values_*
falsepositives:
    - Unlikely
level: high
direct high
Uncommon Microsoft Office Trusted Location Added
Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
status test author Nasreddine Bencherchali (Nextron Systems) id f742bde7-9528-42e5-bd82-84f51a8387d2 license Sigma · DRL-1.1
view Sigma YAML 
title: Uncommon Microsoft Office Trusted Location Added
id: f742bde7-9528-42e5-bd82-84f51a8387d2
related:
    - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac
      type: derived
status: test
description: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions.
references:
    - Internal Research
    - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-21
modified: 2023-09-29
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'Security\Trusted Locations\Location'
        TargetObject|endswith: '\Path'
    filter_exclude_known_paths:
        Details|contains:
            - '%APPDATA%\Microsoft\Templates'
            - '%%APPDATA%%\Microsoft\Templates'
            - '%APPDATA%\Microsoft\Word\Startup'
            - '%%APPDATA%%\Microsoft\Word\Startup'
            - ':\Program Files (x86)\Microsoft Office\root\Templates\'
            - ':\Program Files\Microsoft Office (x86)\Templates'
            - ':\Program Files\Microsoft Office\root\Templates\'
            - ':\Program Files\Microsoft Office\Templates\'
    filter_main_office_click_to_run:
        Image|contains: ':\Program Files\Common Files\Microsoft Shared\ClickToRun\'
        Image|endswith: '\OfficeClickToRun.exe'
    filter_main_office_apps:
        Image|contains:
            - ':\Program Files\Microsoft Office\'
            - ':\Program Files (x86)\Microsoft Office\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_*
falsepositives:
    - Other unknown legitimate or custom paths need to be filtered to avoid false positives
level: high
direct medium
Office Application Initiated Network Connection To Non-Local IP
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses. This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292. This rule will require an initial baseline and tuning that is specific to your organization.
status test author Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) id 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84 license Sigma · DRL-1.1
view Sigma YAML 
title: Office Application Initiated Network Connection To Non-Local IP
id: 75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84
status: test
description: |
    Detects an office application (Word, Excel, PowerPoint)  that initiate a network connection to a non-private IP addresses.
    This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
    This rule will require an initial baseline and tuning that is specific to your organization.
references:
    - https://corelight.com/blog/detecting-cve-2021-42292
    - https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
date: 2021-11-10
modified: 2025-10-17
tags:
    - attack.execution
    - attack.t1203
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\excel.exe'
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\winword.exe'
            - '\wordview.exe'
        Initiated: 'true'
    filter_main_local_ranges:
        DestinationIp|cidr:
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '::1/128'  # IPv6 loopback
            - 'fe80::/10'  # IPv6 link-local addresses
            - 'fc00::/7'  # IPv6 private addresses
    filter_main_msrange_generic:
        DestinationIp|cidr:
            - '2.16.56.0/23' # Akamai International B.V.
            - '2.17.248.0/21' # Akamai International B.V.
            - '13.107.240.0/21' # Microsoft Corporation
            - '20.184.0.0/13' # Microsoft Corporation
            - '23.61.224.0/20' # Akamai-AS
            - '20.192.0.0/10' # Microsoft Corporation
            - '23.72.0.0/13' # Akamai International B.V.
            - '23.3.88.0/22' # Akamai-AS
            - '23.216.132.0/22' # Akamai-AS
            - '40.76.0.0/14' # Microsoft Corporation
            - '51.10.0.0/15' # Microsoft Corporation
            - '51.103.0.0/16' # Microsoft Corporation
            - '51.104.0.0/15' # Microsoft Corporation
            - '51.142.136.0/22' # Microsoft Corporation - https://ipinfo.io/AS8075/51.140.0.0/14-51.142.136.0/22
            - '52.160.0.0/11' # Microsoft Corporation - https://ipinfo.io/AS8075/52.160.0.0/11
            - '95.101.96.0/21' # Akamai-As
            - '204.79.197.0/24' # Microsoft Corporation
    filter_main_msrange_exchange_1:
        # Exchange Online
        # "urls": [
        #       "outlook.cloud.microsoft",
        #       "outlook.office.com",
        #       "outlook.office365.com"
        # ]
        DestinationIp|cidr:
            - '13.107.4.0/22'
            - '13.107.6.152/31'
            - '13.107.18.10/31'
            - '13.107.42.0/23'
            - '13.107.128.0/22'
            - '23.35.224.0/20'
            - '23.53.40.0/22'
            - '23.103.160.0/20'
            - '23.216.76.0/22'
            - '40.96.0.0/13'
            - '40.104.0.0/15'
            - '52.96.0.0/14'
            - '131.253.33.215/32'
            - '132.245.0.0/16'
            - '150.171.32.0/22'
            - '204.79.197.215/32'
            - '2603:1006::/40'
            - '2603:1016::/36'
            - '2603:1026::/36'
            - '2603:1036::/36'
            - '2603:1046::/36'
            - '2603:1056::/36'
            - '2620:1ec:4::152/128'
            - '2620:1ec:4::153/128'
            - '2620:1ec:c::10/128'
            - '2620:1ec:c::11/128'
            - '2620:1ec:d::10/128'
            - '2620:1ec:d::11/128'
            - '2620:1ec:8f0::/46'
            - '2620:1ec:900::/46'
            - '2620:1ec:a92::152/128'
            - '2620:1ec:a92::153/128'
        DestinationPort:
            - 80
            - 443
    filter_main_msrange_exchange_2:
        # Exchange Online
        # "urls": [
        #       "outlook.office365.com",
        #       "smtp.office365.com"
        # ]
        DestinationIp|cidr:
            - '13.107.6.152/31'
            - '13.107.18.10/31'
            - '13.107.128.0/22'
            - '23.103.160.0/20'
            - '40.96.0.0/13'
            - '40.104.0.0/15'
            - '52.96.0.0/14'
            - '131.253.33.215/32'
            - '132.245.0.0/16'
            - '150.171.32.0/22'
            - '204.79.197.215/32'
            - '2603:1006::/40'
            - '2603:1016::/36'
            - '2603:1026::/36'
            - '2603:1036::/36'
            - '2603:1046::/36'
            - '2603:1056::/36'
            - '2620:1ec:4::152/128'
            - '2620:1ec:4::153/128'
            - '2620:1ec:c::10/128'
            - '2620:1ec:c::11/128'
            - '2620:1ec:d::10/128'
            - '2620:1ec:d::11/128'
            - '2620:1ec:8f0::/46'
            - '2620:1ec:900::/46'
            - '2620:1ec:a92::152/128'
            - '2620:1ec:a92::153/128'
        DestinationPort:
            - 143
            - 587
            - 993
            - 995
        Protocol: 'tcp'
    filter_main_msrange_exchange_3:
        # Exchange Online
        # "urls": [
        #       "*.protection.outlook.com"
        #  ]
        DestinationIp|cidr:
            - '40.92.0.0/15'
            - '40.107.0.0/16'
            - '52.100.0.0/14'
            - '52.238.78.88/32'
            - '104.47.0.0/17'
            - '2a01:111:f400::/48'
            - '2a01:111:f403::/48'
        DestinationPort: 443
    filter_main_msrange_exchange_4:
        # Exchange Online
        # "urls": [
        #       "*.mail.protection.outlook.com",
        #       "*.mx.microsoft"
        #  ]
        DestinationIp|cidr:
            - '40.92.0.0/15'
            - '40.107.0.0/16'
            - '52.100.0.0/14'
            - '52.238.78.88/32'
            - '104.47.0.0/17'
            - '2a01:111:f400::/48'
            - '2a01:111:f403::/48'
        DestinationPort: 25
    filter_main_msrange_sharepoint_1:
        # SharePoint Online and OneDrive for Business",
        # "urls": [
        #       "*.sharepoint.com"
        # ]
        DestinationIp|cidr:
            - '13.107.136.0/22'
            - '40.108.128.0/17'
            - '52.104.0.0/14'
            - '104.146.128.0/17'
            - '150.171.40.0/22'
            - '2603:1061:1300::/40'
            - '2620:1ec:8f8::/46'
            - '2620:1ec:908::/46'
            - '2a01:111:f402::/48'
        DestinationPort:
            - 80
            - 443
        Protocol: 'tcp'
    filter_main_msrange_office_1:
        # Microsoft 365 Common and Office Online",
        # "urls": [
        #       "*.officeapps.live.com",
        #       "*.online.office.com",
        #       "office.live.com",
        #       "office.com.akadns.net"
        # ],
        DestinationIp|cidr:
            - '13.107.6.171/32'
            - '13.107.18.15/32'
            - '13.107.140.6/32'
            - '20.64.0.0/10'
            - '52.108.0.0/14'
            - '52.244.37.168/32'
            - '2603:1006:1400::/40'
            - '2603:1016:2400::/40'
            - '2603:1026:2400::/40'
            - '2603:1036:2400::/40'
            - '2603:1046:1400::/40'
            - '2603:1056:1400::/40'
            - '2603:1063:2000::/38'
            - '2620:1ec:c::15/128'
            - '2620:1ec:8fc::6/128'
            - '2620:1ec:a92::171/128'
            - '2a01:111:f100:2000::a83e:3019/128'
            - '2a01:111:f100:2002::8975:2d79/128'
            - '2a01:111:f100:2002::8975:2da8/128'
            - '2a01:111:f100:7000::6fdd:6cd5/128'
            - '2a01:111:f100:a004::bfeb:88cf/128'
        DestinationPort:
            - 80
            - 443
        Protocol: 'tcp'
    filter_main_msrange_office_2:
        # Microsoft 365 Common and Office Online
        # "urls": [
        #       "*.auth.microsoft.com",
        #       "*.msftidentity.com",
        #       "*.msidentity.com",
        #       "account.activedirectory.windowsazure.com",
        #       "accounts.accesscontrol.windows.net",
        #       "adminwebservice.microsoftonline.com",
        #       "api.passwordreset.microsoftonline.com",
        #       "autologon.microsoftazuread-sso.com",
        #       "becws.microsoftonline.com",
        #       "ccs.login.microsoftonline.com",
        #       "clientconfig.microsoftonline-p.net",
        #       "cloudapp.azure.com",
        #       "companymanager.microsoftonline.com",
        #       "device.login.microsoftonline.com",
        #       "graph.microsoft.com",
        #       "graph.windows.net",
        #       "login-us.microsoftonline.com",
        #       "login.microsoft.com",
        #       "login.microsoftonline-p.com",
        #       "login.microsoftonline.com",
        #       "login.windows.net",
        #       "logincert.microsoftonline.com",
        #       "loginex.microsoftonline.com",
        #       "nexus.microsoftonline-p.com",
        #       "passwordreset.microsoftonline.com",
        #       "provisioningapi.microsoftonline.com",
        #       "web.core.windows.net",
        # ]
        DestinationIp|cidr:
            - '172.128.0.0/10'
            - '20.20.32.0/19'
            - '20.103.156.88/32' # msn.com
            - '20.190.128.0/18'
            - '20.231.128.0/19'
            - '40.126.0.0/18'
            - '57.150.0.0/15'
            - '2603:1006:2000::/48'
            - '2603:1007:200::/48'
            - '2603:1016:1400::/48'
            - '2603:1017::/48'
            - '2603:1026:3000::/48'
            - '2603:1027:1::/48'
            - '2603:1036:3000::/48'
            - '2603:1037:1::/48'
            - '2603:1046:2000::/48'
            - '2603:1047:1::/48'
            - '2603:1056:2000::/48'
            - '2603:1057:2::/48'
        DestinationPort:
            - 80
            - 443
        Protocol: 'tcp'
    filter_main_msrange_office_3:
        # Microsoft 365 Common and Office Online
        #  "urls": [
        #       "*.compliance.microsoft.com",
        #       "*.data.microsoft.com",
        #       "*.protection.office.com",
        #       "*.security.microsoft.com",
        #       "compliance.microsoft.com",
        #       "defender.microsoft.com",
        #       "protection.office.com",
        #       "security.microsoft.com",
        #       "teams.microsoft.com",
        #  ]
        DestinationIp|cidr:
            - '13.64.0.0/11'
            - '13.107.6.192/32'
            - '13.107.9.192/32'
            - '13.89.179.14/32'
            - '20.40.0.0/14'
            - '20.48.0.0/12'
            - '20.64.0.0/12'
            - '52.123.0.0/16'
            - '52.108.0.0/14'
            - '52.136.0.0/13'
            - '57.150.0.0/15'
            - '80.239.150.67/32' # Arelion Sweden AB
            - '2620:1ec:4::192/128'
            - '2620:1ec:a92::192/128'
        DestinationPort: 443
        Protocol: 'tcp'
    filter_main_destination_host:
        DestinationHostname|endswith: '.deploy.static.akamaitechnologies.com'
        DestinationPort: 443
        Protocol: 'tcp'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.
    - Office documents commonly have templates that refer to external addresses, like "sharepoint.ourcompany.com" may have to be tuned.
    - It is highly recommended to baseline your activity and tune out common business use cases.
level: medium
direct medium
Office Application Initiated Network Connection Over Uncommon Ports
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
status test author X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) id 3b5ba899-9842-4bc2-acc2-12308498bf42 license Sigma · DRL-1.1
view Sigma YAML 
title: Office Application Initiated Network Connection Over Uncommon Ports
id: 3b5ba899-9842-4bc2-acc2-12308498bf42
status: test
description: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
references:
    - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-12
modified: 2025-10-17
tags:
    - attack.command-and-control
    - attack.stealth
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith:
            - '\excel.exe'
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\winword.exe'
            - '\wordview.exe'
    filter_main_common_ports:
        DestinationPort:
            - 53 # DNS
            - 80 # HTTP
            - 139 # NETBIOS
            - 389 # LDAP
            - 443 # HTTPS
            - 445 # SMB
            - 3268 # MSFT-GC
    filter_main_outlook_ports:
        Image|contains: ':\Program Files\Microsoft Office\'
        Image|endswith: '\OUTLOOK.EXE'
        DestinationPort:
            - 143
            - 465 # SMTP
            - 587 # SMTP
            - 993 # IMAP
            - 995 # POP3
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Other ports can be used, apply additional filters accordingly
level: medium
direct medium
PowerShell Core DLL Loaded Via Office Application
Detects PowerShell core DLL being loaded by an Office Product
status test author Nasreddine Bencherchali (Nextron Systems) id bb2ba6fb-95d4-4a25-89fc-30bb736c021a license Sigma · DRL-1.1
view Sigma YAML 
title: PowerShell Core DLL Loaded Via Office Application
id: bb2ba6fb-95d4-4a25-89fc-30bb736c021a
status: test
description: Detects PowerShell core DLL being loaded by an Office Product
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-01
tags:
    - attack.stealth
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith:
            - '\excel.exe'
            - '\mspub.exe'
            - '\outlook.exe'
            - '\onenote.exe'
            - '\onenoteim.exe' # Just in case
            - '\powerpnt.exe'
            - '\winword.exe'
        ImageLoaded|contains:
            - '\System.Management.Automation.Dll'
            - '\System.Management.Automation.ni.Dll'
    condition: selection
falsepositives:
    - Unknown
level: medium
direct medium
DotNET Assembly DLL Loaded Via Office Application
Detects any assembly DLL being loaded by an Office Product
status test author Antonlovesdnb id ff0f2b05-09db-4095-b96d-1b75ca24894a license Sigma · DRL-1.1
view Sigma YAML 
title: DotNET Assembly DLL Loaded Via Office Application
id: ff0f2b05-09db-4095-b96d-1b75ca24894a
status: test
description: Detects any assembly DLL being loaded by an Office Product
references:
    - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
author: Antonlovesdnb
date: 2020-02-19
modified: 2023-03-29
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith:
            - '\excel.exe'
            - '\mspub.exe'
            - '\onenote.exe'
            - '\onenoteim.exe' # Just in case
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\winword.exe'
        ImageLoaded|startswith: 'C:\Windows\assembly\'
    condition: selection
falsepositives:
    - Unknown
level: medium
direct medium
CLR DLL Loaded Via Office Applications
Detects CLR DLL being loaded by an Office Product
status test author Antonlovesdnb id d13c43f0-f66b-4279-8b2c-5912077c1780 license Sigma · DRL-1.1
view Sigma YAML 
title: CLR DLL Loaded Via Office Applications
id: d13c43f0-f66b-4279-8b2c-5912077c1780
status: test
description: Detects CLR DLL being loaded by an Office Product
references:
    - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
author: Antonlovesdnb
date: 2020-02-19
modified: 2023-03-29
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith:
            - '\excel.exe'
            - '\mspub.exe'
            - '\outlook.exe'
            - '\onenote.exe'
            - '\onenoteim.exe' # Just in case
            - '\powerpnt.exe'
            - '\winword.exe'
        ImageLoaded|contains: '\clr.dll'
    condition: selection
falsepositives:
    - Unknown
level: medium
direct medium
Potential Persistence Via Visual Studio Tools for Office
Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
status test author Bhabesh Raj id 9d15044a-7cfe-4d23-8085-6ebc11df7685 license Sigma · DRL-1.1
view Sigma YAML 
title: Potential Persistence Via Visual Studio Tools for Office
id: 9d15044a-7cfe-4d23-8085-6ebc11df7685
status: test
description: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.
references:
    - https://twitter.com/_vivami/status/1347925307643355138
    - https://vanmieghem.io/stealth-outlook-persistence/
author: Bhabesh Raj
date: 2021-01-10
modified: 2026-01-09
tags:
    - attack.t1137.006
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\Office\Outlook\Addins\'
            - '\Software\Microsoft\Office\Word\Addins\'
            - '\Software\Microsoft\Office\Excel\Addins\'
            - '\Software\Microsoft\Office\Powerpoint\Addins\'
            - '\Software\Microsoft\VSTO\Security\Inclusion\'
    filter_main_system:
        Image:
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
            - 'C:\Windows\System32\regsvr32.exe'
            - 'C:\Windows\SysWOW64\regsvr32.exe' # e.g. default Evernote installation
    filter_main_office_click_to_run:
        Image|startswith:
            - 'C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\'
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
        Image|endswith: '\OfficeClickToRun.exe'
    filter_main_integrator:
        Image:
            - 'C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe'
            - 'C:\Program Files\Microsoft Office\root\integration\integrator.exe'
    filter_main_office_apps:
        Image|startswith:
            - 'C:\Program Files\Microsoft Office\OFFICE'
            - 'C:\Program Files (x86)\Microsoft Office\OFFICE'
            - 'C:\Program Files\Microsoft Office\Root\OFFICE'
            - 'C:\Program Files (x86)\Microsoft Office\Root\OFFICE'
            - 'C:\PROGRA~2\MICROS~2\Office'
        Image|endswith:
            - '\excel.exe'
            - '\Integrator.exe'
            - '\OneNote.exe'
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\Teams.exe'
            - '\visio.exe'
            - '\winword.exe'
    filter_main_vsto:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\VSTO\'
            - 'C:\Program Files (x86)\Microsoft Shared\VSTO\'
        Image|endswith: '\VSTOInstaller.exe'
    filter_optional_avg:
        Image:
            - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
            - 'C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe'
        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
    filter_optional_avast:
        Image:
            - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
            - 'C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe'
        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate Addin Installation
level: medium
direct medium
Office Autorun Keys Modification
Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened. There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive. Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
status test author Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) id baecf8fb-edbf-429f-9ade-31fc3f22b970 license Sigma · DRL-1.1
view Sigma YAML 
title: Office Autorun Keys Modification
id: baecf8fb-edbf-429f-9ade-31fc3f22b970
related:
    - id: 17f878b8-9968-4578-b814-c4217fc5768c
      type: obsolete
status: test
description: |
    Detects modification of autostart extensibility point (ASEP) in registry. Adversaries may modify these keys to execute malicious code when Office files are opened.
    There are various legitimate add-ins that also use these keys and this filter list might not be exhaustive.
    Thus, it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
date: 2019-10-25
modified: 2026-01-09
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
logsource:
    category: registry_set
    product: windows
detection:
    selection_office_root:
        TargetObject|contains:
            - '\Software\Wow6432Node\Microsoft\Office'
            - '\Software\Microsoft\Office'
    selection_office_details:
        TargetObject|contains:
            - '\Word\Addins'
            - '\PowerPoint\Addins'
            - '\Outlook\Addins'
            - '\Onenote\Addins'
            - '\Excel\Addins'
            - '\Access\Addins'
            - 'test\Special\Perf'
    filter_main_empty:
        Details: '(Empty)'
    filter_main_null:
        Details: null
    filter_main_known_addins:
        Image|startswith:
            - 'C:\Program Files\Microsoft Office\'
            - 'C:\Program Files (x86)\Microsoft Office\'
            - 'C:\PROGRA~2\MICROS~2\Office'
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
            - 'C:\Windows\System32\regsvr32.exe'
            - 'C:\Windows\SysWOW64\regsvr32.exe '
        TargetObject|contains:
            # Remove any unused addins in your environment from the filter
            # Known addins for excel
            - '\Excel\Addins\AdHocReportingExcelClientLib.AdHocReportingExcelClientAddIn.1\'
            - '\Excel\Addins\ExcelPlugInShell.PowerMapConnect\'
            - '\Excel\Addins\NativeShim\'
            - '\Excel\Addins\NativeShim.InquireConnector.1\'
            - '\Excel\Addins\PowerPivotExcelClientAddIn.NativeEntry.1\'
            # Known addins for outlook
            - '\Outlook\AddIns\AccessAddin.DC\'
            - '\Outlook\AddIns\ColleagueImport.ColleagueImportAddin\'
            - '\Outlook\AddIns\EvernoteCC.EvernoteContactConnector\'
            - '\Outlook\AddIns\EvernoteOLRD.Connect\'
            # - '\Outlook\Addins\GrammarlyAddIn.Connect' # Uncomment if you use Grammarly
            - '\Outlook\Addins\\OneNote.OutlookAddin'
            - '\Outlook\Addins\DriveFSExtensionLib.Connect\' # An Outlook Add-in to talk with Google Drive
            - '\Outlook\Addins\GoogleAppsSync.Connect\' # Google Apps Sync for Microsoft Outlook
            - '\Outlook\Addins\Microsoft.VbaAddinForOutlook.1\'
            - '\Outlook\Addins\OcOffice.OcForms\'
            - '\Outlook\Addins\OscAddin.Connect\'
            - '\Outlook\Addins\OutlookChangeNotifier.Connect\'
            - '\Outlook\Addins\UCAddin.LyncAddin.1'
            - '\Outlook\Addins\UCAddin.UCAddin.1'
            - '\Outlook\Addins\UmOutlookAddin.FormRegionAddin\'
            - 'AddinTakeNotesService\FriendlyName'
    filter_main_officeclicktorun:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
        Image|endswith: '\OfficeClickToRun.exe'
    filter_main_vsto:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\VSTO\'
            - 'C:\Program Files (x86)\Microsoft Shared\VSTO\'
        Image|endswith: '\VSTOInstaller.exe'
    filter_optional_avg:
        Image:
            - 'C:\Program Files\AVG\Antivirus\RegSvr.exe'
            - 'C:\Program Files\AVG\Antivirus\x86\RegSvr.exe'
        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\'
    filter_optional_avast:
        Image:
            - 'C:\Program Files\Avast Software\Avast\RegSvr.exe'
            - 'C:\Program Files\Avast Software\Avast\x86\RegSvr.exe'
        TargetObject|contains: '\Microsoft\Office\Outlook\Addins\Avast.AsOutExt\'
    # These filters are not exhaustive, filter can be expanded based on environment
    condition: all of selection_office_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate software or add-in installations and administrative configurations
    - Automatic registry modifications during legitimate software installations
level: medium
direct medium
Office Application Startup - Office Test
Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started
status test author omkar72 id 3d27f6dd-1c74-4687-b4fa-ca849d128d1c license Sigma · DRL-1.1
view Sigma YAML 
title: Office Application Startup - Office Test
id: 3d27f6dd-1c74-4687-b4fa-ca849d128d1c
status: test
description: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started
references:
    - https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/
author: omkar72
date: 2020-10-25
modified: 2023-11-08
tags:
    - attack.persistence
    - attack.t1137.002
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Office test\Special\Perf'
    condition: selection
falsepositives:
    - Unlikely
level: medium
direct low
Office Macro File Creation
Detects the creation of a new office macro files on the systems
status test author Nasreddine Bencherchali (Nextron Systems) id 91174a41-dc8f-401b-be89-7bfc140612a0 license Sigma · DRL-1.1
view Sigma YAML 
title: Office Macro File Creation
id: 91174a41-dc8f-401b-be89-7bfc140612a0
related:
    - id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
      type: similar
status: test
description: Detects the creation of a new office macro files on the systems
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
    - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-23
modified: 2026-01-09
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '.docm'
            - '.dotm'
            - '.xlsm'
            - '.xltm'
            - '.potm'
            - '.pptm'
    filter_main_office:
        Image|startswith:
            - 'C:\Program Files\Microsoft Office\'
            - 'C:\Program Files (x86)\Microsoft Office\'
        Image|endswith:
            - '\WINWORD.EXE'
            - '\EXCEL.EXE'
            - '\POWERPNT.EXE'
        TargetFilename|contains: '\~$' # Temporary files created by Office applications
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Very common in environments that rely heavily on macro documents
level: low
direct low
Office Macro File Download
Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.
status test author Nasreddine Bencherchali (Nextron Systems) id 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 license Sigma · DRL-1.1
view Sigma YAML 
title: Office Macro File Download
id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
related:
    - id: 91174a41-dc8f-401b-be89-7bfc140612a0
      type: similar
status: test
description: |
    Detects the creation of a new office macro files on the system via an application (browser, mail client).
    This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
    - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-23
modified: 2025-10-29
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection_processes:
        Image|endswith:
            # Email clients
            - '\RuntimeBroker.exe' # Windows Email clients uses RuntimeBroker to create the files
            - '\outlook.exe'
            - '\thunderbird.exe'
            # Browsers
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\maxthon.exe'
            - '\MicrosoftEdge.exe'
            - '\msedge.exe'
            - '\msedgewebview2.exe'
            - '\opera.exe'
            - '\safari.exe'
            - '\seamonkey.exe'
            - '\vivaldi.exe'
            - '\whale.exe'
    selection_ext:
        - TargetFilename|endswith:
              - '.docm'
              - '.dotm'
              - '.xlsm'
              - '.xltm'
              - '.potm'
              - '.pptm'
        - TargetFilename|contains:
              - '.docm:Zone'
              - '.dotm:Zone'
              - '.xlsm:Zone'
              - '.xltm:Zone'
              - '.potm:Zone'
              - '.pptm:Zone'
    condition: all of selection_*
falsepositives:
    - Legitimate macro files downloaded from the internet
    - Legitimate macro files sent as attachments via emails
level: low
Showing 51-67 of 67
Prev 2 Next
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin