Windows Office Binaries Downloading Files via HTTP(S) Potentially Arbitrary Payload
Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2022-05-17
- Updated
- 2026-09-25
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where Microsoft Office-related binaries (EXCEL.EXE, MSOXMLED.EXE, POWERPNT.EXE, WINWORD.exe) are launched with command lines containing http:// or https://. That behavior can indicate an attacker using Office binaries to retrieve external content, potentially leading to arbitrary file download and subsequent execution. It relies on Windows process creation telemetry, specifically the executable image/OriginalFileName and the presence of HTTP(S) URLs in the command line.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Msoxmled/
- medium.comhttps://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-09-25
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Office Binaries Downloading Files via HTTP(S) Potentially Arbitrary Payload
id: 117f8387-7a39-40ae-9b67-919c66f0e38c
related:
- id: 0c79148b-118e-472b-bdb7-9b57b444cc19
type: obsolete
- id: 4ae3e30b-b03f-43aa-87e3-b622f4048eed
type: derived
status: test
description: This rule flags process creation where Microsoft Office-related binaries (EXCEL.EXE, MSOXMLED.EXE, POWERPNT.EXE, WINWORD.exe) are launched with command lines containing http:// or https://. That behavior can indicate an attacker using Office binaries to retrieve external content, potentially leading to arbitrary file download and subsequent execution. It relies on Windows process creation telemetry, specifically the executable image/OriginalFileName and the presence of HTTP(S) URLs in the command line.
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/
- https://lolbas-project.github.io/lolbas/Binaries/Msoxmled/
- https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community, Huntrule Team
date: 2022-05-17
modified: 2026-09-25
tags:
- attack.stealth
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \EXCEL.EXE
- \MSOXMLED.EXE
- \POWERPNT.EXE
- \WINWORD.exe
- OriginalFileName:
- Excel.exe
- msoxmled.exe
- POWERPNT.EXE
- WinWord.exe
selection_http:
CommandLine|contains:
- http://
- https://
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1