SigmaHQ/rules/windows/process_creation/win_office_shell.yml

title: Microsoft Office Product Spawning Windows Shell
status: experimental
description: Detects a Windows command line executable started from Microsoft Word, Excel, Powerpoint, Publisher and Visio.
references:
  - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
  - https://www2.cybereason.com/asset/60:research-cobalt-kitty-attack-lifecycle
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059
  - attack.T1202
author: Michael Haag, Florian Roth, Markus Neis
date: 2018/04/06
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage:
      - '*\WINWORD.EXE'
      - '*\EXCEL.EXE'
      - '*\POWERPNT.exe'
      - '*\MSPUB.exe'
      - '*\VISIO.exe'
      - '*\OUTLOOK.EXE'
    Image:
      - '*\cmd.exe'
      - '*\powershell.exe'
      - '*\wscript.exe'
      - '*\cscript.exe'
      - '*\sh.exe'
      - '*\bash.exe'
      - '*\scrcons.exe'
      - '*\schtasks.exe'
      - '*\regsvr32.exe'
      - '*\hh.exe'
      - '*\wmic.exe'
      - '*\mshta.exe'
      - '*\rundll32.exe'
      - '*\msiexec.exe'
      - '*\forfiles.exe'
      - '*\scriptrunner.exe'
      - '*\mftrace.exe'
      - '*\AppVLP.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - unknown
level: high