Windows Office Applications Loading VBE DLLs (VBA Runtime Indicators)

Flags Office apps loading VBA-related VBE DLLs, a strong indicator of VBA macro execution.

FreeUnreviewedSigmahighv1

windows-office-applications-loading-vbe-dlls-vba-runtime-indicators-e6ce8457

title: Windows Office Applications Loading VBE DLLs (VBA Runtime Indicators)
id: cd5277e3-9748-4c5f-a7e6-01f5c4ede788
status: test
description: This rule matches DLL load events where common Microsoft Office executables (EXCEL, OUTLOOK, POWERPNT, WINWORD, MSPUB, ONENOTE) load VBE-related DLLs such as VBE7.DLL, VBEUI.DLL, and VBE7INTL.DLL. Because these DLLs are part of the VBA runtime/editor components, their presence during Office execution can indicate VBA macro activity. The detection relies on image-load telemetry that records the loaded DLL path alongside the parent process image name on Windows.
references:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_vbadll_load.yml
author: Antonlovesdnb, Huntrule Team
date: 2020-02-19
modified: 2023-02-10
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \mspub.exe
      - \onenote.exe
      - \onenoteim.exe
      - \outlook.exe
      - \powerpnt.exe
      - \winword.exe
    ImageLoaded|endswith:
      - \VBE7.DLL
      - \VBEUI.DLL
      - \VBE7INTL.DLL
  condition: selection
falsepositives:
  - Legitimate macro usage. Add the appropriate filter according to your environment
level: high
license: DRL-1.1
related:
  - id: e6ce8457-68b1-485b-9bdd-3c2b5d679aa9
    type: derived

What it detects

This rule matches DLL load events where common Microsoft Office executables (EXCEL, OUTLOOK, POWERPNT, WINWORD, MSPUB, ONENOTE) load VBE-related DLLs such as VBE7.DLL, VBEUI.DLL, and VBE7INTL.DLL. Because these DLLs are part of the VBA runtime/editor components, their presence during Office execution can indicate VBA macro activity. The detection relies on image-load telemetry that records the loaded DLL path alongside the parent process image name on Windows.

Known false positives

Legitimate macro usage. Add the appropriate filter according to your environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.