name: Office Application Drop Executable
id: 73ce70c4-146d-11ec-9184-acde48001122
version: 1
date: '2021-09-13'
author: Teoderick Contreras, Michael Haag Splunk
type: TTP
datamodel:
- Endpoint
description: This search is to detect a suspicious MS office application that drop
  or create executables or script in the host. This behavior is commonly seen in spear
  phishing office attachment where it drop malicious files or script to compromised
  the host. It might be some normal macro may drop script or tools as part of automation
  but still this behavior is reallly suspicious and not commonly seen in normal office
  application
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
  | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
  where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1")
  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
  file_name file_path process_name process_path process] | dedup file_create_time
  | table dest, process_name, process, file_create_time, file_name, file_path | `office_application_drop_executable_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: office macro for automation may do this behavior
references:
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
- https://attack.mitre.org/groups/G0046/
tags:
  analytic_story:
  - FIN7
  automated_detection_testing: passed
  confidence: 80
  context:
  - Source:Endpoint
  - Stage:recon
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
  impact: 80
  kill_chain_phases:
  - Exploitation
  message: process $process_name$ drops a file $TargetFilename$ in host $dest$
  mitre_attack_id:
  - T1566
  - T1566.001
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  - name: process_name
    type: process name
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Image
  - TargetFilename
  - ProcessGuid
  - dest
  - user_id
  risk_score: 64
  security_domain: endpoint