Windows Office Applications Spawning Child Processes With Directory Traversal Strings

Alerts on Office parent processes launching child commands containing directory traversal patterns.

FreeUnreviewedSigmahighv1

windows-office-applications-spawning-child-processes-with-directory-traversal-st-868955d9

title: Windows Office Applications Spawning Child Processes With Directory Traversal Strings
id: 0e429bef-0831-419c-9369-afceafb88013
status: test
description: This rule flags when common Windows Office executables (WinWord, Excel, PowerPoint, Access, Publisher, Visio, and Equation Editor) spawn child processes whose command line contains directory traversal patterns. Directory traversal strings like repeated "../" or "..\\..\\..\\.." may indicate attempts to access or load attacker-controlled locations outside expected paths. The detection relies on process creation telemetry, matching the parent Office application path and suspicious substrings in the child process command line.
references:
  - https://twitter.com/sbousseaden/status/1531653369546301440
  - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40444
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444_office_directory_traversal.yml
author: Christian Burkard (Nextron Systems), @SBousseaden (idea), Huntrule Team
date: 2022-06-02
modified: 2023-02-04
tags:
  - attack.execution
  - cve.2021-40444
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \winword.exe
      - \excel.exe
      - \powerpnt.exe
      - \msaccess.exe
      - \mspub.exe
      - \eqnedt32.exe
      - \visio.exe
    CommandLine|contains:
      - ../../../..
      - ..\..\..\..
      - ..//..//..//..
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 868955d9-697e-45d4-a3da-360cefd7c216
    type: derived

What it detects

This rule flags when common Windows Office executables (WinWord, Excel, PowerPoint, Access, Publisher, Visio, and Equation Editor) spawn child processes whose command line contains directory traversal patterns. Directory traversal strings like repeated "../" or "..\\..\\..\\.." may indicate attempts to access or load attacker-controlled locations outside expected paths. The detection relies on process creation telemetry, matching the parent Office application path and suspicious substrings in the child process command line.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.