Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Alerts when onenote.exe spawns suspicious script or system execution child processes on Windows, consistent with malicious OneNote payload behavior.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) (SigmaHQ), DRL 1.1
Published: 2022-10-21
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566Phishing
- T1566.001Spearphishing Attachment
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where Microsoft OneNote (onenote.exe) spawns child processes whose executable name matches common scripting and system execution utilities, or that run via explorer.exe launching script/HTA content. This matters because OneNote can be abused to execute embedded or external payloads, and attackers often leverage living-off-the-land binaries and script execution to run malicious code. Telemetry relies on Windows process creation fields including the parent image, child image/original filename, and command-line indicators for script/HTA file types.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange

Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on Suspicious HH.EXE Process Execution

Suspicious Office Application Spawning Regsvr32 via Process Chain (via process_creation)

Suspicious OneNote Spawning Command or Script Interpreter via Spear-Phishing (via process_creation)

Suspicious Microsoft Entra Device Code Authentication Flow

Suspicious RDP Connection File Opened From Download or Mail Directory via Process Creation

Suspicious Code of Conduct Phishing Email From cocinternal.com Sender (via m365)

Suspicious Office Application Spawning Script Interpreter

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Pivot detection · T1566.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-process-execution-by-microsoft-onenote-on-windows-child-programs-c27515df

title: Suspicious Process Execution by Microsoft OneNote on Windows Child Programs
id: 6c1af172-829e-43aa-8752-7c601d273f9d
related:
  - id: 438025f9-5856-4663-83f7-52f878a70a50
    type: derived
  - id: c27515df-97a9-4162-8a60-dc0eeb51b775
    type: derived
status: test
description: This rule flags process creation events where Microsoft OneNote (onenote.exe) spawns child processes whose executable name matches common scripting and system execution utilities, or that run via explorer.exe launching script/HTA content. This matters because OneNote can be abused to execute embedded or external payloads, and attackers often leverage living-off-the-land binaries and script execution to run malicious code. Telemetry relies on Windows process creation fields including the parent image, child image/original filename, and command-line indicators for script/HTA file types.
references:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18
  - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml
author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea), Huntrule Team
date: 2022-10-21
modified: 2023-02-10
tags:
  - attack.t1566
  - attack.t1566.001
  - attack.initial-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \onenote.exe
  selection_opt_img:
    - OriginalFileName:
        - bitsadmin.exe
        - CertOC.exe
        - CertUtil.exe
        - Cmd.Exe
        - CMSTP.EXE
        - cscript.exe
        - curl.exe
        - HH.exe
        - IEExec.exe
        - InstallUtil.exe
        - javaw.exe
        - Microsoft.Workflow.Compiler.exe
        - msdt.exe
        - MSHTA.EXE
        - msiexec.exe
        - Msxsl.exe
        - odbcconf.exe
        - pcalua.exe
        - PowerShell.EXE
        - RegAsm.exe
        - RegSvcs.exe
        - REGSVR32.exe
        - RUNDLL32.exe
        - schtasks.exe
        - ScriptRunner.exe
        - wmic.exe
        - WorkFolders.exe
        - wscript.exe
    - Image|endswith:
        - \AppVLP.exe
        - \bash.exe
        - \bitsadmin.exe
        - \certoc.exe
        - \certutil.exe
        - \cmd.exe
        - \cmstp.exe
        - \control.exe
        - \cscript.exe
        - \curl.exe
        - \forfiles.exe
        - \hh.exe
        - \ieexec.exe
        - \installutil.exe
        - \javaw.exe
        - \mftrace.exe
        - \Microsoft.Workflow.Compiler.exe
        - \msbuild.exe
        - \msdt.exe
        - \mshta.exe
        - \msidb.exe
        - \msiexec.exe
        - \msxsl.exe
        - \odbcconf.exe
        - \pcalua.exe
        - \powershell.exe
        - \pwsh.exe
        - \regasm.exe
        - \regsvcs.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \schtasks.exe
        - \scrcons.exe
        - \scriptrunner.exe
        - \sh.exe
        - \svchost.exe
        - \verclsid.exe
        - \wmic.exe
        - \workfolders.exe
        - \wscript.exe
  selection_opt_explorer:
    Image|endswith: \explorer.exe
    CommandLine|contains:
      - .hta
      - .vb
      - .wsh
      - .js
      - .ps
      - .scr
      - .pif
      - .bat
      - .cmd
  selection_opt_paths:
    Image|contains:
      - \AppData\
      - \Users\Public\
      - \ProgramData\
      - \Windows\Tasks\
      - \Windows\Temp\
      - \Windows\System32\Tasks\
  filter_teams:
    Image|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe
    CommandLine|endswith: -Embedding
  filter_onedrive:
    Image|contains: \AppData\Local\Microsoft\OneDrive\
    Image|endswith: \FileCoAuth.exe
    CommandLine|endswith: -Embedding
  condition: selection_parent and 1 of selection_opt_* and not 1 of filter_*
falsepositives:
  - File located in the AppData folder with trusted signature
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL