Windows Office Applications Downloading Files via HTTP/HTTPS

title: Windows Office Applications Downloading Files via HTTP/HTTPS
id: 117f8387-7a39-40ae-9b67-919c66f0e38c
related:
  - id: 0c79148b-118e-472b-bdb7-9b57b444cc19
    type: obsolete
  - id: 4ae3e30b-b03f-43aa-87e3-b622f4048eed
    type: derived
status: test
description: This rule flags process executions where Microsoft Office binaries (EXCEL.EXE, POWERPNT.EXE, WINWORD.exe) are launched with command lines containing HTTP or HTTPS URLs. Attackers may abuse Office applications to fetch and stage arbitrary payloads over the network, enabling stealthy execution chains. The detection relies on Windows process creation telemetry, specifically the process image name and command-line content containing web URLs.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/
  - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community, Huntrule Team
date: 2022-05-17
modified: 2023-06-22
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \EXCEL.EXE
        - \POWERPNT.EXE
        - \WINWORD.exe
    - OriginalFileName:
        - Excel.exe
        - POWERPNT.EXE
        - WinWord.exe
  selection_http:
    CommandLine|contains:
      - http://
      - https://
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1