Windows Office Binary Execution with Renamed Image Path
Alerts when Office apps are executed under renamed or unexpected image paths, helping catch stealthy masquerading on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-20
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where an Office application executable (Excel, Word, Outlook, PowerPoint, OneNote, Access, Publisher, or Olk) is launched but the image path does not end with commonly seen legitimate binary filenames. Attackers may rename trusted Office binaries to evade allowlists and normal detection patterns while preserving the original file metadata. The detection relies on Windows process creation telemetry and matches against OriginalFileName and Description fields, then applies exclusions using image path suffixes.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Office Binary Execution with Renamed Image Path
id: de31f739-cd78-4468-9254-da001f61ae71
status: test
description: This rule flags process creation events where an Office application executable (Excel, Word, Outlook, PowerPoint, OneNote, Access, Publisher, or Olk) is launched but the image path does not end with commonly seen legitimate binary filenames. Attackers may rename trusted Office binaries to evade allowlists and normal detection patterns while preserving the original file metadata. The detection relies on Windows process creation telemetry and matches against OriginalFileName and Description fields, then applies exclusions using image path suffixes.
references:
- https://infosec.exchange/@sbousseaden/109542254124022664
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_office_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-20
modified: 2025-12-09
tags:
- attack.stealth
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection:
- OriginalFileName:
- Excel.exe
- MSACCESS.EXE
- MSPUB.EXE
- OneNote.exe
- OneNoteM.exe
- OUTLOOK.EXE
- POWERPNT.EXE
- WinWord.exe
- Olk.exe
- Description:
- Microsoft Access
- Microsoft Excel
- Microsoft OneNote
- Microsoft Outlook
- Microsoft PowerPoint
- Microsoft Publisher
- Microsoft Word
- Sent to OneNote Tool
filter_main_legit_names:
Image|endswith:
- \EXCEL.exe
- \excelcnv.exe
- \MSACCESS.exe
- \MSPUB.EXE
- \ONENOTE.EXE
- \ONENOTEM.EXE
- \OUTLOOK.EXE
- \POWERPNT.EXE
- \WINWORD.exe
- \OLK.EXE
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 0b0cd537-fc77-4e6e-a973-e53495c1083d
type: derived