huntrule

Suspicious Script Interpreter Spawned by OneNote via Embedded Attachment (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-22
Updated
2026-10-22
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects OneNote spawning a command shell, script host, or download utility, which indicates an embedded attachment was executed. Multiple actors abused OneNote .one files to launch cmd, PowerShell, wscript, mshta, or curl to retrieve AsyncRAT, XWorm, Qbot, and DOUBLEBACK.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious ClickFix Command Execution via RunMRU Registry Key
Suspicious PowerShell Download Spawned From Explorer via ClickFix (via process_creation)
Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog
Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File
Suspicious Encoded PowerShell Spawned from Explorer via ClickFix
Malicious Office Application Spawning Command Interpreter
Suspicious Office Application Spawning Script Interpreter
Suspicious Microsoft Word Spawning PowerShell
Malicious Office Application Spawning PowerShell with Encoded Command
Suspicious Script Interpreter Spawned by OneNote via Embedded Attachment (via process_creation)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.