mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
80 lines
3.1 KiB
YAML
80 lines
3.1 KiB
YAML
name: Office Document Executing Macro Code
|
|
id: b12c89bc-9d06-11eb-a592-acde48001122
|
|
version: 4
|
|
date: '2023-01-24'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: this detection was designed to identifies suspicious office documents
|
|
that using macro code. Macro code is known to be one of the prevalent weaponization
|
|
or attack vector of threat actor. This malicious macro code is embed to a office
|
|
document as an attachment that may execute malicious payload, download malware payload
|
|
or other malware component. It is really good practice to disable macro by default
|
|
to avoid automatically execute macro code while opening or closing a office document
|
|
files.
|
|
data_source:
|
|
- Sysmon Event ID 7
|
|
search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE",
|
|
"POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe")
|
|
ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
|
|
as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
|
|
by Computer EventCode Image process_name ProcessId ProcessGuid | rename Computer as dest| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
|
|
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
Also be sure to include those monitored dll to your own sysmon config.
|
|
known_false_positives: Normal Office Document macro use for automation
|
|
references:
|
|
- https://www.joesandbox.com/analysis/386500/0/html
|
|
- https://www.joesandbox.com/analysis/702680/0/html
|
|
- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
|
|
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
|
|
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
|
|
- https://www.fortinet.com/blog/threat-research/leveraging-microsoft-office-documents-to-deliver-agent-tesla-and-njrat
|
|
tags:
|
|
analytic_story:
|
|
- Spearphishing Attachments
|
|
- Trickbot
|
|
- IcedID
|
|
- DarkCrystal RAT
|
|
- AgentTesla
|
|
- Qakbot
|
|
- Azorult
|
|
- Remcos
|
|
- PlugX
|
|
- NjRAT
|
|
asset_type: Endpoint
|
|
confidence: 50
|
|
impact: 70
|
|
message: Office document executing a macro on $dest$
|
|
mitre_attack_id:
|
|
- T1566
|
|
- T1566.001
|
|
observable:
|
|
- name: dest
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- ImageLoaded
|
|
- AllImageLoaded
|
|
- dest
|
|
- EventCode
|
|
- Image
|
|
- process_name
|
|
- ProcessId
|
|
- ProcessGuid
|
|
- _time
|
|
risk_score: 35
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog |