Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Alerts when onenote.exe spawns suspicious script or system execution child processes on Windows, consistent with malicious OneNote payload behavior.

FreeUnreviewedSigmahighv1

suspicious-process-execution-by-microsoft-onenote-on-windows-child-programs-c27515df

title: Suspicious Process Execution by Microsoft OneNote on Windows Child Programs
id: 6c1af172-829e-43aa-8752-7c601d273f9d
related:
  - id: 438025f9-5856-4663-83f7-52f878a70a50
    type: derived
  - id: c27515df-97a9-4162-8a60-dc0eeb51b775
    type: derived
status: test
description: This rule flags process creation events where Microsoft OneNote (onenote.exe) spawns child processes whose executable name matches common scripting and system execution utilities, or that run via explorer.exe launching script/HTA content. This matters because OneNote can be abused to execute embedded or external payloads, and attackers often leverage living-off-the-land binaries and script execution to run malicious code. Telemetry relies on Windows process creation fields including the parent image, child image/original filename, and command-line indicators for script/HTA file types.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18
  - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml
author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-10-21
modified: 2023-02-10
tags:
  - attack.t1566
  - attack.t1566.001
  - attack.initial-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \onenote.exe
  selection_opt_img:
    - OriginalFileName:
        - bitsadmin.exe
        - CertOC.exe
        - CertUtil.exe
        - Cmd.Exe
        - CMSTP.EXE
        - cscript.exe
        - curl.exe
        - HH.exe
        - IEExec.exe
        - InstallUtil.exe
        - javaw.exe
        - Microsoft.Workflow.Compiler.exe
        - msdt.exe
        - MSHTA.EXE
        - msiexec.exe
        - Msxsl.exe
        - odbcconf.exe
        - pcalua.exe
        - PowerShell.EXE
        - RegAsm.exe
        - RegSvcs.exe
        - REGSVR32.exe
        - RUNDLL32.exe
        - schtasks.exe
        - ScriptRunner.exe
        - wmic.exe
        - WorkFolders.exe
        - wscript.exe
    - Image|endswith:
        - \AppVLP.exe
        - \bash.exe
        - \bitsadmin.exe
        - \certoc.exe
        - \certutil.exe
        - \cmd.exe
        - \cmstp.exe
        - \control.exe
        - \cscript.exe
        - \curl.exe
        - \forfiles.exe
        - \hh.exe
        - \ieexec.exe
        - \installutil.exe
        - \javaw.exe
        - \mftrace.exe
        - \Microsoft.Workflow.Compiler.exe
        - \msbuild.exe
        - \msdt.exe
        - \mshta.exe
        - \msidb.exe
        - \msiexec.exe
        - \msxsl.exe
        - \odbcconf.exe
        - \pcalua.exe
        - \powershell.exe
        - \pwsh.exe
        - \regasm.exe
        - \regsvcs.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \schtasks.exe
        - \scrcons.exe
        - \scriptrunner.exe
        - \sh.exe
        - \svchost.exe
        - \verclsid.exe
        - \wmic.exe
        - \workfolders.exe
        - \wscript.exe
  selection_opt_explorer:
    Image|endswith: \explorer.exe
    CommandLine|contains:
      - .hta
      - .vb
      - .wsh
      - .js
      - .ps
      - .scr
      - .pif
      - .bat
      - .cmd
  selection_opt_paths:
    Image|contains:
      - \AppData\
      - \Users\Public\
      - \ProgramData\
      - \Windows\Tasks\
      - \Windows\Temp\
      - \Windows\System32\Tasks\
  filter_teams:
    Image|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe
    CommandLine|endswith: -Embedding
  filter_onedrive:
    Image|contains: \AppData\Local\Microsoft\OneDrive\
    Image|endswith: \FileCoAuth.exe
    CommandLine|endswith: -Embedding
  condition: selection_parent and 1 of selection_opt_* and not 1 of filter_*
falsepositives:
  - File located in the AppData folder with trusted signature
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where Microsoft OneNote (onenote.exe) spawns child processes whose executable name matches common scripting and system execution utilities, or that run via explorer.exe launching script/HTA content. This matters because OneNote can be abused to execute embedded or external payloads, and attackers often leverage living-off-the-land binaries and script execution to run malicious code. Telemetry relies on Windows process creation fields including the parent image, child image/original filename, and command-line indicators for script/HTA file types.

Known false positives

File located in the AppData folder with trusted signature

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.