name: Office Application Drop Executable
id: 73ce70c4-146d-11ec-9184-acde48001122
version: 1
date: '2021-09-13'
author: Teoderick Contreras, Michael Haag Splunk
status: production
type: TTP
description: This search is to detect a suspicious MS office application that drops
  or creates executables or scripts in a Windows Operating System. This behavior is
  commonly seen in spear phishing office attachment where it drop malicious files
  or script to compromised the host. It might be some normal macro may drop script
  or tools as part of automation but still this behavior is reallly suspicious and
  not commonly seen in normal office application
data_source:
- Sysmon Event ID 1
search:
  selection1:
    Image|endswith:
    - winword.exe
    - excel.exe
    - powerpnt.exe
    - mspub.exe
    - visio.exe
    - wordpad.exe
    - wordview.exe
  condition: selection1
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: office macro for automation may do this behavior
references:
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
- https://www.joesandbox.com/analysis/702680/0/html
tags:
  analytic_story:
  - FIN7
  - AgentTesla
  asset_type: Endpoint
  confidence: 80
  impact: 80
  message: process $process_name$ drops a file $TargetFilename$ in host $dest$
  mitre_attack_id:
  - T1566
  - T1566.001
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  - name: process_name
    type: Process
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 64
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog