splunk-security_content/removed/detections/office_application_drop_executable.yml

name: Office Application Drop Executable
id: 73ce70c4-146d-11ec-9184-acde48001122
version: 11
date: '2025-02-10'
author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github
status: removed
type: TTP
description: The following analytic has been deprecated. The following analytic detects
  Microsoft Office applications dropping or creating executables or scripts on a Windows
  OS. It leverages process creation and file system events from the Endpoint data
  model to identify Office applications like Word or Excel generating files with extensions
  such as .exe, .dll, or .ps1. This behavior is significant as it is often associated
  with spear-phishing attacks where malicious files are dropped to compromise the
  host. If confirmed malicious, this activity could lead to code execution, privilege
  escalation, or persistent access, posing a severe threat to the environment.
data_source:
- Sysmon EventID 1 AND Sysmon EventID 11
search: '| tstats prestats=t `security_content_summariesonly` count min(_time) as
  firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name
  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe")
  by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
  Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
  Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
  Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
  Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product
  | `drop_dm_object_name(Processes)` | tstats prestats=t append=t `security_content_summariesonly`
  count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
  where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1")
  by Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time
  Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
  Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id
  Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)` |
  table action dest original_file_name parent_process parent_process_exec parent_process_guid
  parent_process_id parent_process_name parent_process_path process process_exec process_guid
  process_hash process_id process_integrity_level process_name process_path user user_id
  vendor_product file_access_time file_create_time file_hash file_modify_time file_name
  file_path file_acl file_size firstTime lastTime | stats values(action) as action
  values(dest) as dest values(original_file_name) as original_file_name values(parent_process)
  as parent_process values(dest) as dest values(original_file_name) as original_file_name
  values(parent_process) as parent_process values(parent_process_exec) as parent_process_exec
  values(parent_process_guid) as parent_process_guid values(parent_process_id) as
  parent_process_id values(parent_process_name) as parent_process_name values(parent_process_path)
  as parent_process_path values(process) as process values(process_exec) as process_exec
  values(process_hash) as process_hash values(process_id) as process_id values(process_integrity_level)
  as process_integrity_level values(process_name) as process_name values(process_path)
  as process_path values(user) as user values(user_id) as user_id values(vendor_product)
  as vendor_product values(file_access_time) as file_access_time values(file_create_time)
  as file_create_time values(file_hash) as file_hash values(file_modify_time) as file_modify_time
  values(file_name) as file_name values(file_path) as file_path values(file_acl) as
  file_acl values(file_size) as file_size by process_guid | where isnotnull(process)
  AND isnotnull(file_name) | `office_application_drop_executable_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: office macro for automation may do this behavior
references:
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
- https://www.joesandbox.com/analysis/702680/0/html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
drilldown_searches:
- name: View the detection results for - "$dest$"
  search: '%original_detection_search% | search  dest = "$dest$"'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
rba:
  message: process $process_name$ drops a file $file_name$ in host $dest$
  risk_objects:
  - field: dest
    type: system
    score: 64
  threat_objects:
  - field: process_name
    type: process_name
tags:
  analytic_story:
  - CVE-2023-21716 Word RTF Heap Corruption
  - Warzone RAT
  - FIN7
  - Compromised Windows Host
  - AgentTesla
  - PlugX
  asset_type: Endpoint
  mitre_attack_id:
  - T1566.001
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: XmlWinEventLog