mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
tcontreras
54 lines
2.2 KiB
YAML
54 lines
2.2 KiB
YAML
name: Office Document Executing Macro Code
|
|
id: b12c89bc-9d06-11eb-a592-acde48001122
|
|
version: 1
|
|
date: '2021-04-14'
|
|
author: Teoderick Contreras, Splunk
|
|
type: batch
|
|
datamodel:
|
|
- Endpoint
|
|
description: this detection was designed to identifies suspicious office documents
|
|
that using macro code. Macro code is known to be one of the prevalent weaponization
|
|
or attack vector of threat actor. This malicious macro code is embed to a office
|
|
document as an attachment that may execute malicious payload, download malware payload
|
|
or other malware component. It is really good practice to disable macro by default
|
|
to avoid automatically execute macro code while opening or closing a office document
|
|
files.
|
|
search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
|
|
ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
|
|
| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded
|
|
count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
|
|
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
Also be sure to include those monitored dll to your own sysmon config.
|
|
known_false_positives: Normal Office Document macro use for automation
|
|
references:
|
|
- https://www.joesandbox.com/analysis/386500/0/html
|
|
tags:
|
|
analytic_story:
|
|
- Spearphishing Attachments
|
|
- Trickbot
|
|
automated_detection_testing: passed
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
|
|
kill_chain_phases:
|
|
- Exploitation
|
|
mitre_attack_id:
|
|
- T1566.001
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- ImageLoaded
|
|
- AllImageLoaded
|
|
- Computer
|
|
- EventCode
|
|
- Image
|
|
- process_name
|
|
- ProcessId
|
|
- ProcessGuid
|
|
- _time
|
|
security_domain: endpoint
|