[[ fm.text ]] Click here

Office application spawning LOLBin with download or obfuscation pattern (CVE-2025-62557)

SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Apache-2.0

Detects Office apps spawning LOLBins with download-and-execute or obfuscation CLI. STRICT high-confidence rule for CVE-2025-62557 exploitation.

title: Office application spawning LOLBin with download or obfuscation pattern (CVE-2025-62557)
id: c5e01c95-2ae7-41bf-8ff2-097512b452d5
status: experimental
description: |
  Detects Office apps spawning LOLBins with download-and-execute or obfuscation CLI. STRICT high-confidence rule for CVE-2025-62557 exploitation. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
  Détecte des applications Office lançant des LOLBins avec des patterns CLI de téléchargement/exécution ou obfuscation (PowerShell -enc, IEX, FromBase64String). Règle STRICT haute confiance pour alertes SOC sur activité post-exploitation CVE-2025-62557. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
related:
  - id: 9da1edff-a287-4ac1-94f6-64a7324e6913
    type: similar

references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-62557
  - https://www.tenable.com/cve/CVE-2025-62557
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62557
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2025-12-23
modified: 2026-06-22
tags:
  - attack.initial-access
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1105
  - attack.t1218
  - cve.2025-62557
logsource:
  product: windows
  category: process_creation
detection:
  selection_office_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msaccess.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
      - '\forfiles.exe'
      - '\pcalua.exe'
      - '\odbcconf.exe'
      - '\wmic.exe'
      - '\curl.exe'
  selection_download_keywords:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'Invoke-WebRequest'
      - ' iwr '
      - 'curl '
      - 'wget '
      - 'bitsadmin'
      - 'certutil'
      - ' -urlcache'
      - ' -split'
  # SECOND CHALLENGE 2026-06-22: ' -enc' (with leading space) misses cases where -enc appears
  # at the start of the command line or after a semicolon/pipe (e.g., ';-enc', '|-enc').
  # 'EncodedCommand' without a leading space was already catching -EncodedCommand variants.
  # Added '-enc ' (no leading space required) as a fallback to cover these edge cases.
  # Also, ' IEX' with leading space misses 'IEX(' at the start of a string - added 'IEX(' explicitly.
  selection_obfuscation_exec:
    CommandLine|contains:
      - ' -enc'
      - '-enc '
      - 'EncodedCommand'
      - '-ec '
      - 'FromBase64String'
      - ' IEX'
      - 'IEX('
      - 'Invoke-Expression'

  filter_main_office_automation:
    ParentCommandLine|contains:
      - '/automation'
      - '/pt '
      - '/embedding'

  condition: selection_office_parent and selection_child and (selection_download_keywords or selection_obfuscation_exec) and not filter_main_office_automation

fields:
  - UtcTime
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
  - User
  - IntegrityLevel
  - ProcessId
  - ParentProcessId

falsepositives:
  - Approved IT scripts launched from Office templates (validate via ticketing and code signatures)
  - Red-team or authorized security testing

level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5b33af94-83f6-4c6a-8073-9d2c5fa682c0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion