[[ fm.text ]] Click here

Microsoft Office spawning LOLBin or script engine

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Broad detection for Office apps spawning LOLBins or script engines. Use for triage and hunting across Office-based exploitation chains.

title: Microsoft Office spawning LOLBin or script engine
id: f94eb6ef-dccf-481b-92c8-8a6c844b8355
status: experimental
description: |
  Broad detection for Office apps spawning LOLBins or script engines. Use for triage and hunting across Office-based exploitation chains. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détection large des applications Microsoft Office lançant des LOLBins communs ou des moteurs de script. Destinée au triage et au hunting. Comportement fréquemment observé dans les chaînes d'exploitation Office (documents malveillants, exécution de contenu externe), incluant plusieurs CVE Office. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
  - https://attack.mitre.org/techniques/T1204/002/
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2025-12-23
modified: 2026-06-19
related:
  - id: a6f0558c-14a3-44e0-88f9-605044bb3ecc
    type: similar
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
  - attack.t1059.001
  - attack.t1218
logsource:
  product: windows
  category: process_creation

detection:
  selection_office_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msaccess.exe'
      - '\visio.exe'
      - '\onenote.exe'

  selection_lolbin_or_script_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\schtasks.exe'
      - '\forfiles.exe'
      - '\pcalua.exe'
      - '\odbcconf.exe'
      - '\wmic.exe'
      - '\curl.exe'

  # /automation, /pt, /embedding are standard COM/OLE invocation modes used by legitimate integrations
  filter_main_office_automation:
    ParentCommandLine|contains:
      - '/automation'
      - '/pt '
      - '/embedding'

  condition: selection_office_parent and selection_lolbin_or_script_child and not filter_main_office_automation

fields:
  - UtcTime
  - Computer
  - User
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

falsepositives:
  - Legitimate Office add-ins or automation that launches scripts/tools (validate with IT change tickets)
  - Enterprise templates/macros invoking PowerShell for approved tasks
  - COM/OLE automation invocations (covered by filter_main_office_automation)

level: medium

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

238801c1-6ff7-421b-82e5-d3ec5d18867e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion