mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
84 lines
3.4 KiB
YAML
84 lines
3.4 KiB
YAML
name: Office Document Executing Macro Code
|
|
id: b12c89bc-9d06-11eb-a592-acde48001122
|
|
version: 6
|
|
date: '2024-05-12'
|
|
author: Teoderick Contreras, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: The following analytic identifies office documents executing macro code.
|
|
It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE
|
|
load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant
|
|
because macros are a common attack vector for delivering malicious payloads, such
|
|
as malware. If confirmed malicious, this could lead to unauthorized code execution,
|
|
data exfiltration, or further compromise of the system. Disabling macros by default
|
|
is recommended to mitigate this risk.
|
|
data_source:
|
|
- Sysmon EventID 7
|
|
search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe")
|
|
loaded_file_path IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
|
|
as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by
|
|
dest EventCode process_name process_guid | `security_content_ctime(firstTime)` |
|
|
`security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
|
|
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
|
Also be sure to include those monitored dll to your own sysmon config.
|
|
known_false_positives: False positives may occur if legitimate office documents are
|
|
executing macro code. Ensure to investigate the macro code and the command to be
|
|
executed. If the macro code is benign, add the document name to the exclusion list.
|
|
Some applications may legitimately load VBE7INTL.DLL, VBE7.DLL, or VBEUI.DLL.
|
|
references:
|
|
- https://www.joesandbox.com/analysis/386500/0/html
|
|
- https://www.joesandbox.com/analysis/702680/0/html
|
|
- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
|
|
- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
|
|
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/
|
|
- https://www.fortinet.com/blog/threat-research/leveraging-microsoft-office-documents-to-deliver-agent-tesla-and-njrat
|
|
tags:
|
|
analytic_story:
|
|
- Spearphishing Attachments
|
|
- Trickbot
|
|
- IcedID
|
|
- DarkCrystal RAT
|
|
- AgentTesla
|
|
- Qakbot
|
|
- Azorult
|
|
- Remcos
|
|
- PlugX
|
|
- NjRAT
|
|
asset_type: Endpoint
|
|
confidence: 50
|
|
impact: 70
|
|
message: Office document executing a macro on $dest$
|
|
mitre_attack_id:
|
|
- T1566
|
|
- T1566.001
|
|
observable:
|
|
- name: dest
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- ImageLoaded
|
|
- AllImageLoaded
|
|
- dest
|
|
- EventCode
|
|
- Image
|
|
- process_name
|
|
- ProcessId
|
|
- ProcessGuid
|
|
- _time
|
|
risk_score: 35
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|