title: HTML Help HH.EXE Suspicious Child Process
id: 52cad028-0ff0-4854-8f67-d25dfcbc78b4
status: test
description: Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
    - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
    - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
date: 2020-04-01
modified: 2023-04-12
tags:
    - attack.execution
    - attack.initial-access
    - attack.stealth
    - attack.t1047
    - attack.t1059.001
    - attack.t1059.003
    - attack.t1059.005
    - attack.t1059.007
    - attack.t1218
    - attack.t1218.001
    - attack.t1218.010
    - attack.t1218.011
    - attack.t1566
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\hh.exe'
        Image|endswith:
            - '\CertReq.exe'
            - '\CertUtil.exe'
            - '\cmd.exe'
            - '\cscript.exe'
            - '\installutil.exe'
            - '\MSbuild.exe'
            - '\MSHTA.EXE'
            - '\msiexec.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\schtasks.exe'
            - '\wmic.exe'
            - '\wscript.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: ISO File Created Within Temp Folders
id: 2f9356ae-bf43-41b8-b858-4496d83b2acb
status: test
description: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.
references:
    - https://twitter.com/Sam0x90/status/1552011547974696960
    - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html
    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
author: '@sam0x90'
date: 2022-07-30
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection_1:
        TargetFilename|contains|all:
            - '\AppData\Local\Temp\'
            - '.zip\'
        TargetFilename|endswith: '.iso'
    selection_2:
        TargetFilename|contains: '\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\'
        TargetFilename|endswith: '.iso'
    condition: 1 of selection*
falsepositives:
    - Potential FP by sysadmin opening a zip file containing a legitimate ISO file
level: high

title: Office Macro File Creation From Suspicious Process
id: b1c50487-1967-4315-a026-6491686d860e
status: test
description: Detects the creation of a office macro file from a a suspicious process
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
    - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-23
modified: 2023-02-22
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
    definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data'
detection:
    selection_cmd:
        - Image|endswith:
              - '\cscript.exe'
              - '\mshta.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\wscript.exe'
        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11
        - ParentImage|endswith:
              - '\cscript.exe'
              - '\mshta.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\wscript.exe'
    selection_ext:
        TargetFilename|endswith:
            - '.docm'
            - '.dotm'
            - '.xlsm'
            - '.xltm'
            - '.potm'
            - '.pptm'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Password Protected ZIP File Opened (Email Attachment)
id: 571498c8-908e-40b4-910b-d2369159a3da
status: test
description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
references:
    - https://twitter.com/sbousseaden/status/1523383197513379841
author: Florian Roth (Nextron Systems)
date: 2022-05-09
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1027
    - attack.t1566.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5379
        TargetName|contains|all:
            - 'Microsoft_Windows_Shell_ZipFolder:filename'
            - '\Temporary Internet Files\Content.Outlook'
    condition: selection
falsepositives:
    - Legitimate used of encrypted ZIP files
level: high

title: Suspicious Double Extension File Execution
id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
related:
    - id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c # ParentImage/ParentCommandLine
      type: similar
status: stable
description: Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
references:
    - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html
    - https://twitter.com/blackorbird/status/1140519090961825792
    - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)
date: 2019-06-26
modified: 2025-05-30
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '      .exe'
            - '______.exe'
            - '.doc.exe'
            - '.doc.js'
            - '.docx.exe'
            - '.docx.js'
            - '.gif.exe'
            - '.jpeg.exe'
            - '.jpg.exe'
            - '.mkv.exe'
            - '.mov.exe'
            - '.mp3.exe'
            - '.mp4.exe'
            - '.pdf.exe'
            - '.pdf.js'
            - '.png.exe'
            - '.ppt.exe'
            - '.ppt.js'
            - '.pptx.exe'
            - '.pptx.js'
            - '.rtf.exe'
            - '.rtf.js'
            - '.svg.exe'
            - '.txt.exe'
            - '.txt.js'
            - '.xls.exe'
            - '.xls.js'
            - '.xlsx.exe'
            - '.xlsx.js'
            - '⠀⠀⠀⠀⠀⠀.exe' # Unicode Space Character: Braille Pattern Blank (Unicode: U+2800)
        CommandLine|contains:
            - '      .exe'
            - '______.exe'
            - '.doc.exe'
            - '.doc.js'
            - '.docx.exe'
            - '.docx.js'
            - '.gif.exe'
            - '.jpeg.exe'
            - '.jpg.exe'
            - '.mkv.exe'
            - '.mov.exe'
            - '.mp3.exe'
            - '.mp4.exe'
            - '.pdf.exe'
            - '.pdf.js'
            - '.png.exe'
            - '.ppt.exe'
            - '.ppt.js'
            - '.pptx.exe'
            - '.pptx.js'
            - '.rtf.exe'
            - '.rtf.js'
            - '.svg.exe'
            - '.txt.exe'
            - '.txt.js'
            - '.xls.exe'
            - '.xls.js'
            - '.xlsx.exe'
            - '.xlsx.js'
            - '⠀⠀⠀⠀⠀⠀.exe' # Unicode Space Character: Braille Pattern Blank (Unicode: U+2800)
    condition: selection
falsepositives:
    - Unknown
level: high

title: Suspicious Execution From Outlook Temporary Folder
id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39
status: test
description: Detects a suspicious program execution in Outlook temp folder
author: Florian Roth (Nextron Systems)
references:
    - Internal Research
date: 2019-10-01
modified: 2022-10-09
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains: '\Temporary Internet Files\Content.Outlook\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Suspicious File Created in Outlook Temporary Directory
id: fabb0e80-030c-4e3e-a104-d09676991ac3
related:
    - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f
      type: obsolete
status: experimental
description: |
    Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.
    This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
references:
    - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
    - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
    - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-22
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    product: windows
    category: file_event
detection:
    selection_extension:
        TargetFilename|endswith:
            - '.cpl'
            - '.hta'
            - '.iso'
            - '.rdp'
            - '.svg'
            - '.vba'
            - '.vbe'
            - '.vbs'
    selection_location:
        - TargetFilename|contains:
              - '\AppData\Local\Packages\Microsoft.Outlook_'
              - '\AppData\Local\Microsoft\Olk\Attachments\'
        - TargetFilename|contains|all:
              - '\AppData\Local\Microsoft\Windows\'
              - '\Content.Outlook\'
    condition: all of selection_*
falsepositives:
    - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments
level: high

title: Suspicious HH.EXE Execution
id: e8a95b5e-c891-46e2-b33a-93937d3abc31
status: test
description: Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
    - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
    - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
author: Maxim Pavlunin
date: 2020-04-01
modified: 2023-04-12
tags:
    - attack.execution
    - attack.initial-access
    - attack.stealth
    - attack.t1047
    - attack.t1059.001
    - attack.t1059.003
    - attack.t1059.005
    - attack.t1059.007
    - attack.t1218
    - attack.t1218.001
    - attack.t1218.010
    - attack.t1218.011
    - attack.t1566
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'HH.exe'
        - Image|endswith: '\hh.exe'
    selection_paths:
        CommandLine|contains:
            - '.application'
            - '\AppData\Local\Temp\'
            - '\Content.Outlook\'
            - '\Downloads\'
            - '\Users\Public\'
            - '\Windows\Temp\'
            # - '\AppData\Local\Temp\Temp?_'
            # - '\AppData\Local\Temp\Rar$'
            # - '\AppData\Local\Temp\7z'
            # - '\AppData\Local\Temp\wz'
            # - '\AppData\Local\Temp\peazip-tmp'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Suspicious HWP Sub Processes
id: 023394c4-29d5-46ab-92b8-6a534c6f447b
status: test
description: Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
references:
    - https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/
    - https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1
    - https://twitter.com/cyberwar_15/status/1187287262054076416
    - https://blog.alyac.co.kr/1901
    - https://en.wikipedia.org/wiki/Hangul_(word_processor)
author: Florian Roth (Nextron Systems)
date: 2019-10-24
modified: 2021-11-27
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1203
    - attack.t1059.003
    - attack.g0032
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Hwp.exe'
        Image|endswith: '\gbb.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Suspicious Microsoft OneNote Child Process
id: c27515df-97a9-4162-8a60-dc0eeb51b775
related:
    - id: 438025f9-5856-4663-83f7-52f878a70a50 # Generic rule for suspicious office application child processes
      type: derived
status: test
description: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
references:
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18
    - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0
author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
date: 2022-10-21
modified: 2023-02-10
tags:
    - attack.t1566
    - attack.t1566.001
    - attack.initial-access
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\onenote.exe'
    selection_opt_img:
        - OriginalFileName:
              - 'bitsadmin.exe'
              - 'CertOC.exe'
              - 'CertUtil.exe'
              - 'Cmd.Exe'
              - 'CMSTP.EXE'
              - 'cscript.exe'
              - 'curl.exe'
              - 'HH.exe'
              - 'IEExec.exe'
              - 'InstallUtil.exe'
              - 'javaw.exe'
              - 'Microsoft.Workflow.Compiler.exe'
              - 'msdt.exe'
              - 'MSHTA.EXE'
              - 'msiexec.exe'
              - 'Msxsl.exe'
              - 'odbcconf.exe'
              - 'pcalua.exe'
              - 'PowerShell.EXE'
              - 'RegAsm.exe'
              - 'RegSvcs.exe'
              - 'REGSVR32.exe'
              - 'RUNDLL32.exe'
              - 'schtasks.exe'
              - 'ScriptRunner.exe'
              - 'wmic.exe'
              - 'WorkFolders.exe'
              - 'wscript.exe'
        - Image|endswith:
              - '\AppVLP.exe'
              - '\bash.exe'
              - '\bitsadmin.exe'
              - '\certoc.exe'
              - '\certutil.exe'
              - '\cmd.exe'
              - '\cmstp.exe'
              - '\control.exe'
              - '\cscript.exe'
              - '\curl.exe'
              - '\forfiles.exe'
              - '\hh.exe'
              - '\ieexec.exe'
              - '\installutil.exe'
              - '\javaw.exe'
              - '\mftrace.exe'
              - '\Microsoft.Workflow.Compiler.exe'
              - '\msbuild.exe'
              - '\msdt.exe'
              - '\mshta.exe'
              - '\msidb.exe'
              - '\msiexec.exe'
              - '\msxsl.exe'
              - '\odbcconf.exe'
              - '\pcalua.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\regasm.exe'
              - '\regsvcs.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\schtasks.exe'
              - '\scrcons.exe'
              - '\scriptrunner.exe'
              - '\sh.exe'
              - '\svchost.exe'
              - '\verclsid.exe'
              - '\wmic.exe'
              - '\workfolders.exe'
              - '\wscript.exe'
    selection_opt_explorer:
        Image|endswith: '\explorer.exe'
        CommandLine|contains:
            - '.hta'
            - '.vb'
            - '.wsh'
            - '.js'
            - '.ps'
            - '.scr'
            - '.pif'
            - '.bat'
            - '.cmd'
    selection_opt_paths:
        Image|contains:
            - '\AppData\'
            - '\Users\Public\'
            - '\ProgramData\'
            - '\Windows\Tasks\'
            - '\Windows\Temp\'
            - '\Windows\System32\Tasks\'
    filter_teams:
        Image|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
        CommandLine|endswith: '-Embedding'
    filter_onedrive:
        Image|contains: '\AppData\Local\Microsoft\OneDrive\'
        Image|endswith: '\FileCoAuth.exe'
        CommandLine|endswith: '-Embedding'
    condition: selection_parent and 1 of selection_opt_* and not 1 of filter_*
falsepositives:
    - File located in the AppData folder with trusted signature
level: high

title: Arbitrary Shell Command Execution Via Settingcontent-Ms
id: 24de4f3b-804c-4165-b442-5a06a2302c7e
status: test
description: The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
references:
    - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
author: Sreeman
date: 2020-03-13
modified: 2022-04-14
tags:
    - attack.t1204
    - attack.t1566.001
    - attack.execution
    - attack.initial-access
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '.SettingContent-ms'
    filter:
        CommandLine|contains: 'immersivecontrolpanel'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium

title: Disk Image Mounting Via Hdiutil - MacOS
id: bf241472-f014-4f01-a869-96f99330ca8c
status: test
description: Detects the execution of the hdiutil utility in order to mount disk images.
references:
    - https://www.loobins.io/binaries/hdiutil/
    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
    - https://ss64.com/mac/hdiutil.html
author: Omar Khaled (@beacon_exe)
date: 2024-08-10
tags:
    - attack.initial-access
    - attack.collection
    - attack.t1566.001
    - attack.t1560.001
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: /hdiutil
        CommandLine|contains:
            - 'attach '
            - 'mount '
    condition: selection
falsepositives:
    - Legitimate usage of hdiutil by administrators and users.
level: medium

title: ISO Image Mounted
id: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073
status: test
description: Detects the mount of an ISO image on an endpoint
references:
    - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
    - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
    - https://twitter.com/MsftSecIntel/status/1257324139515269121
    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
author: Syed Hasan (@syedhasan009)
date: 2021-05-29
modified: 2023-11-09
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure'
detection:
    selection:
        EventID: 4663
        ObjectServer: 'Security'
        ObjectType: 'File'
        ObjectName|startswith: '\Device\CdRom'
    filter_main_generic:
        ObjectName:
            - '\Device\CdRom0\autorun.ico'
            - '\Device\CdRom0\setup.exe'
            - '\Device\CdRom0\setup64.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Software installation ISO files
level: medium

title: ISO or Image Mount Indicator in Recent Files
id: 4358e5a5-7542-4dcb-b9f3-87667371839b
status: test
description: |
    Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
    This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
references:
    - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
    - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
    - https://blog.emsisoft.com/en/32373/beware-new-wave-of-malware-spreads-via-iso-file-email-attachments/
    - https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/
author: Florian Roth (Nextron Systems)
date: 2022-02-11
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '.iso.lnk'
            - '.img.lnk'
            - '.vhd.lnk'
            - '.vhdx.lnk'
        TargetFilename|contains: '\Microsoft\Windows\Recent\'
    condition: selection
falsepositives:
    - Cases in which a user mounts an image file for legitimate reasons
level: medium

title: Potential Initial Access via DLL Search Order Hijacking
id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
status: test
description: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
references:
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
    - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
author: Tim Rauch (rule), Elastic (idea)
date: 2022-10-21
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1566
    - attack.t1566.001
    - attack.initial-access
    - attack.t1574
    - attack.t1574.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            # add more processes when you find them
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\MSACCESS.EXE'
            - '\MSPUB.EXE'
            - '\fltldr.exe'
            - '\cmd.exe'
            - '\certutil.exe'
            - '\mshta.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\curl.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        TargetFilename|endswith: '.dll'
        TargetFilename|contains|all:
            - '\Users\'
            - '\AppData\'
        TargetFilename|contains:
            # add more suspicious paths when you find them
            - '\Microsoft\OneDrive\'
            - '\Microsoft OneDrive\'
            - '\Microsoft\Teams\'
            - '\Local\slack\app-'
            - '\Local\Programs\Microsoft VS Code\'
    filter:
        Image|endswith: '\cmd.exe'
        TargetFilename|contains|all:
            - '\Users\'
            - '\AppData\'
            - '\Microsoft\OneDrive\'
            - '\api-ms-win-core-'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium

title: Suspicious Email Delivered In Microsoft 365
id: 3569aefd-e535-4391-8c18-24bd01a21eaf
status: experimental
description: |
    Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder.
    It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
references:
    - https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
    - https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
    - https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-01-27
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.t1566.002
logsource:
    service: audit
    product: m365
detection:
    selection:
        Workload: 'ThreatIntelligence'
        Operation: 'TIMailData'
        Directionality: 'Inbound'
    filter_main_blocked:
        DeliveryAction: 'Blocked'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: medium

title: Windows Registry Trust Record Modification
id: 295a59c1-7b79-4b47-a930-df12c15fc9c2
related:
    - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd
      type: similar
status: test
description: Alerts on trust record modification within the registry, indicating usage of macros
references:
    - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
    - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html
    - https://twitter.com/inversecos/status/1494174785621819397
author: Antonlovesdnb, Trent Liffick (@tliffick)
date: 2020-02-19
modified: 2023-06-21
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: '\Security\Trusted Documents\TrustRecords'
    condition: selection
falsepositives:
    - This will alert on legitimate macro usage as well, additional tuning is required
level: medium

title: Office Macro File Creation
id: 91174a41-dc8f-401b-be89-7bfc140612a0
related:
    - id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
      type: similar
status: test
description: Detects the creation of a new office macro files on the systems
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
    - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-23
modified: 2026-01-09
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '.docm'
            - '.dotm'
            - '.xlsm'
            - '.xltm'
            - '.potm'
            - '.pptm'
    filter_main_office:
        Image|startswith:
            - 'C:\Program Files\Microsoft Office\'
            - 'C:\Program Files (x86)\Microsoft Office\'
        Image|endswith:
            - '\WINWORD.EXE'
            - '\EXCEL.EXE'
            - '\POWERPNT.EXE'
        TargetFilename|contains: '\~$' # Temporary files created by Office applications
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Very common in environments that rely heavily on macro documents
level: low

title: Office Macro File Download
id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
related:
    - id: 91174a41-dc8f-401b-be89-7bfc140612a0
      type: similar
status: test
description: |
    Detects the creation of a new office macro files on the system via an application (browser, mail client).
    This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
    - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-23
modified: 2025-10-29
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection_processes:
        Image|endswith:
            # Email clients
            - '\RuntimeBroker.exe' # Windows Email clients uses RuntimeBroker to create the files
            - '\outlook.exe'
            - '\thunderbird.exe'
            # Browsers
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\maxthon.exe'
            - '\MicrosoftEdge.exe'
            - '\msedge.exe'
            - '\msedgewebview2.exe'
            - '\opera.exe'
            - '\safari.exe'
            - '\seamonkey.exe'
            - '\vivaldi.exe'
            - '\whale.exe'
    selection_ext:
        - TargetFilename|endswith:
              - '.docm'
              - '.dotm'
              - '.xlsm'
              - '.xltm'
              - '.potm'
              - '.pptm'
        - TargetFilename|contains:
              - '.docm:Zone'
              - '.dotm:Zone'
              - '.xlsm:Zone'
              - '.xltm:Zone'
              - '.potm:Zone'
              - '.pptm:Zone'
    condition: all of selection_*
falsepositives:
    - Legitimate macro files downloaded from the internet
    - Legitimate macro files sent as attachments via emails
level: low