mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-08 02:08:54 +00:00
31 lines
895 B
YAML
31 lines
895 B
YAML
title: VBA DLL Loaded Via Microsoft Word
|
|
id: e6ce8457-68b1-485b-9bdd-3c2b5d679aa9
|
|
status: experimental
|
|
description: Detects DLL's Loaded Via Word Containing VBA Macros
|
|
references:
|
|
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
|
|
author: Antonlovesdnb
|
|
date: 2020/02/19
|
|
tags:
|
|
- attack.initial_access
|
|
- attack.t1193
|
|
logsource:
|
|
product: windows
|
|
service: sysmon
|
|
detection:
|
|
selection:
|
|
EventID: 7
|
|
Image:
|
|
- '*\winword.exe'
|
|
- '*\powerpnt.exe'
|
|
- '*\excel.exe'
|
|
- '*\outlook.exe'
|
|
ImageLoaded:
|
|
- '*\VBE7.DLL'
|
|
- '*\VBEUI.DLL'
|
|
- '*\VBE7INTL.DLL'
|
|
condition: selection
|
|
falsepositives:
|
|
- Alerts on legitimate macro usage as well, will need to filter as appropriate
|
|
level: high
|