Potentially Suspicious Office Document Executed From Trusted Location

SIGMA detection rule by Nasreddine Bencherchali (Nextron Systems) · GPL-2.0

Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

title: Potentially Suspicious Office Document Executed From Trusted Location
id: 773a2339-22b1-7f0c-c821-a5831b6a43cc
related:
    - id: f99abdf0-6283-4e71-bd2b-b5c048a94743
      type: derived
status: test
description: Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.
references:
    - Internal Research
    - https://twitter.com/Max_Mal_/status/1633863678909874176
    - https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465
    - https://twitter.com/_JohnHammond/status/1588155401752788994
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-21
modified: 2023-10-18
tags:
    - attack.stealth
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_parent:
        # Note: we add a parent shell to reduce FP. Add additional 3rd party shells that you might use
        ParentProcessName|endswith:
            - \explorer.exe
            - \dopus.exe
    selection_img:
        - NewProcessName|endswith:
              - \EXCEL.EXE
              - \POWERPNT.EXE
              - \WINWORD.exe
        - OriginalFileName:
              - Excel.exe
              - POWERPNT.EXE
              - WinWord.exe
    selection_trusted_location:
        CommandLine|contains:
            # Note: these are the default locations. Admins/Users could add additional ones that you need to cover
            - \AppData\Roaming\Microsoft\Templates
            - \AppData\Roaming\Microsoft\Word\Startup\
            - \Microsoft Office\root\Templates\
            - \Microsoft Office\Templates\
    filter_main_dotx:
        # Note: We add this filter to avoid curious people clicking on template files
        CommandLine|endswith:
            - .dotx
            - .xltx
            - .potx
    condition: process_creation and (all of selection_* and not 1 of filter_main_*)
falsepositives:
    - Unknown
level: high
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

97e7912b-b53d-4a0f-921a-bf549ce23931

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion