Windows Office Binary Execution with Renamed Image Path

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036.003Rename Legitimate Utilities
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where an Office application executable (Excel, Word, Outlook, PowerPoint, OneNote, Access, Publisher, or Olk) is launched but the image path does not end with commonly seen legitimate binary filenames. Attackers may rename trusted Office binaries to evade allowlists and normal detection patterns while preserving the original file metadata. The detection relies on Windows process creation telemetry and matches against OriginalFileName and Description fields, then applies exclusions using image path suffixes.

Reporting behind it

Related detections9 linkedT1036.003 — drag to rearrange

Renamed Autohotkey Binary

Suspicious Masqueraded Rundll32 with Mismatched Original Filename (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Renamed Execution of a Renamed Windows System Utility (via process_creation)

Suspicious Renamed Pythonw Interpreter Execution via XWorm Loader (via process_creation)

Suspicious PowerShell Masquerading as Windows Terminal via process_creation

Windows Schtasks Execution with Renamed schtasks.exe Binary

Windows RMM Tool MeshAgent Execution with Renamed MeshServiceName

macOS Process Creation: MeshAgent renamed execution via --meshServiceName

Windows Office Binary Execution with Renamed Image Path

Pivot detection · T1036.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-office-binary-execution-with-renamed-image-path-0b0cd537

title: Windows Office Binary Execution with Renamed Image Path
id: de31f739-cd78-4468-9254-da001f61ae71
status: test
description: This rule flags process creation events where an Office application executable (Excel, Word, Outlook, PowerPoint, OneNote, Access, Publisher, or Olk) is launched but the image path does not end with commonly seen legitimate binary filenames. Attackers may rename trusted Office binaries to evade allowlists and normal detection patterns while preserving the original file metadata. The detection relies on Windows process creation telemetry and matches against OriginalFileName and Description fields, then applies exclusions using image path suffixes.
references:
  - https://infosec.exchange/@sbousseaden/109542254124022664
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_office_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-20
modified: 2025-12-09
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName:
        - Excel.exe
        - MSACCESS.EXE
        - MSPUB.EXE
        - OneNote.exe
        - OneNoteM.exe
        - OUTLOOK.EXE
        - POWERPNT.EXE
        - WinWord.exe
        - Olk.exe
    - Description:
        - Microsoft Access
        - Microsoft Excel
        - Microsoft OneNote
        - Microsoft Outlook
        - Microsoft PowerPoint
        - Microsoft Publisher
        - Microsoft Word
        - Sent to OneNote Tool
  filter_main_legit_names:
    Image|endswith:
      - \EXCEL.exe
      - \excelcnv.exe
      - \MSACCESS.exe
      - \MSPUB.EXE
      - \ONENOTE.EXE
      - \ONENOTEM.EXE
      - \OUTLOOK.EXE
      - \POWERPNT.EXE
      - \WINWORD.exe
      - \OLK.EXE
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0b0cd537-fc77-4e6e-a973-e53495c1083d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL