OneNote Attachment File Dropped In Suspicious Location (via file_event)

title: OneNote Attachment File Dropped In Suspicious Location (via file_event)
id: ca9185ef-105b-5ad7-b55e-8f3feca9d3d2
status: stable
description: This rule detects creation of files with the ".one"/".onepkg" extension in anomalous or uncommon locations. This could be a sign of adversaries abusing OneNote attachments
references:
    - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
    - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
author: Huntrule Team
date: 2026-01-31
tags:
    - attack.stealth
    - attack.initial-access
    - attack.defense-evasion
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
            - '\Windows\Temp\'
            - ':\Temp\'
        TargetFilename|endswith:
            - '.one'
            - '.onepkg'
    filter_main_onenote:
        Image|contains: ':\Program Files\Microsoft Office\'
        Image|endswith: '\ONENOTE.EXE'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium