Windows Office Applications Downloading Files via HTTP/HTTPS
Detects Office binaries invoked with command lines containing http/https, indicating potential arbitrary file download.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2022-05-17
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where Microsoft Office binaries (EXCEL.EXE, POWERPNT.EXE, WINWORD.exe) are launched with command lines containing HTTP or HTTPS URLs. Attackers may abuse Office applications to fetch and stage arbitrary payloads over the network, enabling stealthy execution chains. The detection relies on Windows process creation telemetry, specifically the process image name and command-line content containing web URLs.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/
- medium.comhttps://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Office Applications Downloading Files via HTTP/HTTPS
id: 117f8387-7a39-40ae-9b67-919c66f0e38c
related:
- id: 0c79148b-118e-472b-bdb7-9b57b444cc19
type: obsolete
- id: 4ae3e30b-b03f-43aa-87e3-b622f4048eed
type: derived
status: test
description: This rule flags process executions where Microsoft Office binaries (EXCEL.EXE, POWERPNT.EXE, WINWORD.exe) are launched with command lines containing HTTP or HTTPS URLs. Attackers may abuse Office applications to fetch and stage arbitrary payloads over the network, enabling stealthy execution chains. The detection relies on Windows process creation telemetry, specifically the process image name and command-line content containing web URLs.
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/
- https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml
author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community, Huntrule Team
date: 2022-05-17
modified: 2023-06-22
tags:
- attack.stealth
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \EXCEL.EXE
- \POWERPNT.EXE
- \WINWORD.exe
- OriginalFileName:
- Excel.exe
- POWERPNT.EXE
- WinWord.exe
selection_http:
CommandLine|contains:
- http://
- https://
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1