splunk-security_content/dev/endpoint/office_application_spawn_regsvr32_process.yml

name: Office Application Spawn Regsvr32 process
id: 2d9fc90c-f11f-11eb-9300-acde48001122
version: 2
date: '2021-07-30'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: this detection was designed to identifies suspicious spawned process
  of known MS office application due to macro or malicious code. this technique can
  be seen in so many malware like IcedID that used MS office as its weapon or attack
  vector to initially infect the machines.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    ParentImage:
    - winword.exe
    - excel.exe
    - powerpnt.exe
    - outlook.exe
  condition: (selection1)
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: unknown
references:
- https://www.joesandbox.com/analysis/380662/0/html
tags:
  analytic_story:
  - IcedID
  - Qakbot
  asset_type: Endpoint
  confidence: 90
  impact: 70
  message: Office application spawning regsvr32.exe on $dest$
  mitre_attack_id:
  - T1566
  - T1566.001
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 63
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog