huntrule

Windows Office Binary Execution with Renamed Image Path

Alerts when Office apps are executed under renamed or unexpected image paths, helping catch stealthy masquerading on Windows.

FreeUnreviewedSigmahighv1
title: Windows Office Binary Execution with Renamed Image Path
id: de31f739-cd78-4468-9254-da001f61ae71
status: test
description: This rule flags process creation events where an Office application executable (Excel, Word, Outlook, PowerPoint, OneNote, Access, Publisher, or Olk) is launched but the image path does not end with commonly seen legitimate binary filenames. Attackers may rename trusted Office binaries to evade allowlists and normal detection patterns while preserving the original file metadata. The detection relies on Windows process creation telemetry and matches against OriginalFileName and Description fields, then applies exclusions using image path suffixes.
references:
  - https://infosec.exchange/@sbousseaden/109542254124022664
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_office_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-20
modified: 2025-12-09
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName:
        - Excel.exe
        - MSACCESS.EXE
        - MSPUB.EXE
        - OneNote.exe
        - OneNoteM.exe
        - OUTLOOK.EXE
        - POWERPNT.EXE
        - WinWord.exe
        - Olk.exe
    - Description:
        - Microsoft Access
        - Microsoft Excel
        - Microsoft OneNote
        - Microsoft Outlook
        - Microsoft PowerPoint
        - Microsoft Publisher
        - Microsoft Word
        - Sent to OneNote Tool
  filter_main_legit_names:
    Image|endswith:
      - \EXCEL.exe
      - \excelcnv.exe
      - \MSACCESS.exe
      - \MSPUB.EXE
      - \ONENOTE.EXE
      - \ONENOTEM.EXE
      - \OUTLOOK.EXE
      - \POWERPNT.EXE
      - \WINWORD.exe
      - \OLK.EXE
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0b0cd537-fc77-4e6e-a973-e53495c1083d
    type: derived

What it detects

This rule flags process creation events where an Office application executable (Excel, Word, Outlook, PowerPoint, OneNote, Access, Publisher, or Olk) is launched but the image path does not end with commonly seen legitimate binary filenames. Attackers may rename trusted Office binaries to evade allowlists and normal detection patterns while preserving the original file metadata. The detection relies on Windows process creation telemetry and matches against OriginalFileName and Description fields, then applies exclusions using image path suffixes.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.