more onenotes

detections/endpoint/mshtml_module_load_in_office_product.yml

@@ -11,7 +11,7 @@ description: The following detection identifies the module load of mshtml.dll in
   malicious document will load ActiveX, which activates the MSHTML component. The
   vulnerability resides in the MSHTML component. During triage, identify parallel
   processes and capture any file modifications for analysis.
-search: '`sysmon` EventID=7  parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe")
+search: '`sysmon` EventID=7  parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
   ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
   ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`

detections/endpoint/office_application_drop_executable.yml

@@ -13,7 +13,7 @@ description: This search is to detect a suspicious MS office application that dr
   but still this behavior is reallly suspicious and not commonly seen in normal office
   application
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe")
+  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
   Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
   proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count

detections/endpoint/office_application_spawn_regsvr32_process.yml

@@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious spawned proces
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
-  = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe" OR Processes.parent_process_name = "onenote.exe") `process_regsvr32`
+  = "powerpnt.exe" OR Processes.parent_process_name = "outlook.exe" OR Processes.parent_process_name = "onenote.exe" OR Processes.parent_process_name = "onenotem.exe" OR Processes.parent_process_name = "onenoteviewer.exe" OR Processes.parent_process_name = "onenoteim.exe") `process_regsvr32`
   by Processes.parent_process_name Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`

detections/endpoint/office_application_spawn_rundll32_process.yml

@@ -12,7 +12,7 @@ description: This detection was designed to identify suspicious spawned processe
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
-  = "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe") AND `process_rundll32` by Processes.parent_process Processes.process_name
+  = "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe" OR Processes.parent_process_name = "onenotem.exe" OR Processes.parent_process_name = "onenoteviewer.exe" OR Processes.parent_process_name = "onenoteim.exe") AND `process_rundll32` by Processes.parent_process Processes.process_name
   Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `office_application_spawn_rundll32_process_filter`'

detections/endpoint/office_document_creating_schedule_task.yml

@@ -19,7 +19,7 @@ description: this search detects a potential malicious office document that crea
   source. Was it schtasks.exe or via TaskService? Review the job created and the Command
   to be executed. Capture any artifacts on disk and review. Identify any parallel
   processes within the same timeframe to identify source.'
-search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe")
+search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
   ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
   values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name
   ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

detections/endpoint/office_document_executing_macro_code.yml

@@ -13,7 +13,7 @@ description: this detection was designed to identifies suspicious office documen
   or other malware component. It is really good practice to disable macro by default
   to avoid automatically execute macro code while opening or closing a office document
   files.
-search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe")
+search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
   ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
   as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
   by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`

detections/endpoint/office_document_spawned_child_process_to_download.yml

@@ -12,7 +12,7 @@ description: This search is to detect potential malicious office document execut
   blend it to the normal noise in the infected machine to cover its track.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") Processes.process
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") Processes.process
   IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe"))  by
   Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name

detections/endpoint/office_product_spawn_cmd_process.yml

@@ -14,7 +14,7 @@ description: this search is to detect a suspicious office product process that s
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
-  = "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe") `process_cmd` by Processes.parent_process Processes.process_name
+  = "powerpnt.exe" OR Processes.parent_process_name= "onenote.exe" OR Processes.parent_process_name = "onenotem.exe" OR Processes.parent_process_name = "onenoteviewer.exe" OR Processes.parent_process_name = "onenoteim.exe") `process_cmd` by Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
   Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `office_product_spawn_cmd_process_filter`'

detections/endpoint/office_product_spawning_bitsadmin.yml

@@ -19,7 +19,7 @@ description: The following detection identifies the latest behavior utilized by
   for further activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_bitsadmin`
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") `process_bitsadmin`
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`

detections/endpoint/office_product_spawning_certutil.yml

@@ -18,7 +18,7 @@ description: The following detection identifies the latest behavior utilized by
   for further activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_certutil`
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") `process_certutil`
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`

detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml

@@ -18,7 +18,7 @@ description: The following detection identifies the latest behavior utilized by
   additional parallel processes for further activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_rundll32`
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") `process_rundll32`
   (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`

detections/endpoint/office_product_spawning_windows_script_host.yml

@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") Processes.process_name IN ("wscript.exe", "cscript.exe")
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") Processes.process_name IN ("wscript.exe", "cscript.exe")
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`

detections/endpoint/office_product_spawning_wmic.yml

@@ -18,7 +18,7 @@ description: The following detection identifies the latest behavior utilized by
   activity.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe") `process_wmic`
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") `process_wmic`
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`

detections/endpoint/office_product_writing_cab_or_inf.yml

@@ -11,7 +11,7 @@ description: The following analytic identifies behavior related to CVE-2021-4044
   (.inf, .cab). During triage, review parallel processes and further activity on endpoint
   to identify additional patterns. Retrieve the file modifications and analyze further.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes 
-  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe") 
+  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe") 
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
   | `drop_dm_object_name(Processes)`
   |rename process_guid as proc_guid

detections/endpoint/office_spawning_control.yml

@@ -15,7 +15,7 @@ description: The following detection identifies control.exe spawning from an off
   identify further suspicious behavior
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe")
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
   Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|

detections/endpoint/windows_office_product_spawning_msdt.yml

@@ -14,7 +14,7 @@ description: The following analytic identifies a Microsoft Office product spawni
   processes including PowerShell and CertUtil.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe","onenote.exe")
+  IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
   Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|