name: Office Document Executing Macro Code
id: b12c89bc-9d06-11eb-a592-acde48001122
version: 4
date: '2023-01-24'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: this detection was designed to identifies suspicious office documents
  that using macro code. Macro code is known to be one of the prevalent weaponization
  or attack vector of threat actor. This malicious macro code is embed to a office
  document as an attachment that may execute malicious payload, download malware payload
  or other malware component. It is really good practice to disable macro by default
  to avoid automatically execute macro code while opening or closing a office document
  files.
data_source:
- Sysmon Event ID 7
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE",
  "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe")
  ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
  as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
  by Computer EventCode Image process_name ProcessId ProcessGuid | rename Computer as dest| `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
  Also be sure to include those monitored dll to your own sysmon config.
known_false_positives: Normal Office Document macro use for automation
references:
- https://www.joesandbox.com/analysis/386500/0/html
- https://www.joesandbox.com/analysis/702680/0/html
- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
tags:
  analytic_story:
  - Spearphishing Attachments
  - Trickbot
  - IcedID
  - DarkCrystal RAT
  - AgentTesla
  - Qakbot
  - Azorult
  - Remcos
  asset_type: Endpoint
  confidence: 50
  impact: 70
  message: Office document executing a macro on $dest$
  mitre_attack_id:
  - T1566
  - T1566.001
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - ImageLoaded
  - AllImageLoaded
  - dest
  - EventCode
  - Image
  - process_name
  - ProcessId
  - ProcessGuid
  - _time
  risk_score: 35
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog