name: Office Application Drop Executable
id: 73ce70c4-146d-11ec-9184-acde48001122
version: 2
date: '2023-01-24'
author: Teoderick Contreras, Michael Haag Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to detect a suspicious MS office application that drops
  or creates executables or scripts in a Windows Operating System. This behavior is commonly seen in spear
  phishing office attachment where it drop malicious files or script to compromised
  the host. It might be some normal macro may drop script or tools as part of automation
  but still this behavior is reallly suspicious and not commonly seen in normal office
  application
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe")
  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
  Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as
  proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count
  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
  where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1")
  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
  Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)`
  | rename process_guid as proc_guid | fields _time dest file_create_time file_name
  file_path process_name process_path process proc_guid] | dedup file_create_time
  | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid
  | `office_application_drop_executable_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: office macro for automation may do this behavior
references:
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
- https://www.joesandbox.com/analysis/702680/0/html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
  analytic_story:
  - FIN7
  - AgentTesla
  confidence: 80
  context:
  - Source:Endpoint
  - Stage:Recon
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
  impact: 80
  kill_chain_phases:
  - Exploitation
  message: process $process_name$ drops a file $TargetFilename$ in host $dest$
  mitre_attack_id:
  - T1566
  - T1566.001
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  - name: process_name
    type: Process
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Image
  - TargetFilename
  - ProcessGuid
  - dest
  - user_id
  risk_score: 64
  security_domain: endpoint
  asset_type: Endpoint