Windows: Suspicious Executable Created in Temp by OneNote (onenote.exe/onenotem.exe/onenoteim.exe)
Alerts when OneNote creates files in Temp\OneNote with script/executable extensions on Windows.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-09
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where OneNote-related processes create files under the OneNote temp directory in AppData\Local\Temp\OneNote\ and the target filename ends with common script/executable-like extensions. Such activity can indicate an attacker leveraging OneNote to drop or stage malicious payloads for execution. It relies on Windows file event telemetry capturing the creating process image path and the target file path/extension.
Reporting behind it
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
- blog.osarmor.comhttps://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
- twitter.comhttps://twitter.com/MaD_c4t/status/1623414582382567424
- labs.withsecure.comhttps://labs.withsecure.com/publications/detecting-onenote-abuse
- trustedsec.comhttps://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/
- app.any.runhttps://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-detect-onenote-temp-file-creation-with-suspicious-executable-extensions-fcc6d700
title: "Windows: Suspicious Executable Created in Temp by OneNote (onenote.exe/onenotem.exe/onenoteim.exe)"
id: dbcf8862-e0f3-4bb5-8394-eb2e14519011
status: test
description: This rule flags file creation events where OneNote-related processes create files under the OneNote temp directory in AppData\Local\Temp\OneNote\ and the target filename ends with common script/executable-like extensions. Such activity can indicate an attacker leveraging OneNote to drop or stage malicious payloads for execution. It relies on Windows file event telemetry capturing the creating process image path and the target file path/extension.
references:
- https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
- https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
- https://twitter.com/MaD_c4t/status/1623414582382567424
- https://labs.withsecure.com/publications/detecting-onenote-abuse
- https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/
- https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-09
modified: 2023-02-27
tags:
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \onenote.exe
- \onenotem.exe
- \onenoteim.exe
TargetFilename|contains: \AppData\Local\Temp\OneNote\
TargetFilename|endswith:
- .bat
- .chm
- .cmd
- .dll
- .exe
- .hta
- .htm
- .html
- .js
- .lnk
- .ps1
- .vbe
- .vbs
- .wsf
condition: selection
falsepositives:
- False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote.
- Occasional FPs might occur if OneNote is used internally to share different embedded documents
level: high
license: DRL-1.1
related:
- id: fcc6d700-68d9-4241-9a1a-06874d621b06
type: derived