huntrule

Windows: Office Executable Running a Document from Trusted Template/Startup Paths

Alerts when Office apps are launched with command lines pointing to documents under Office template/Startup paths.

FreeUnreviewedSigmahighv1
title: "Windows: Office Executable Running a Document from Trusted Template/Startup Paths"
id: a2b74830-96d9-4f4c-a2ba-96ef88f37cff
status: test
description: This rule flags process creation where an Office application (EXCEL.EXE, POWERPNT.EXE, or WINWORD.EXE) is executed from a parent shell and its command line indicates a target document located in commonly trusted Office template or Startup directories. Such behavior matters because attackers can use trusted locations to reduce user prompts or security friction while launching malicious document content. The detection relies on Windows process creation telemetry, specifically ParentImage, Image/OriginalFileName, and CommandLine path substrings and extensions.
references:
  - Internal Research
  - https://twitter.com/Max_Mal_/status/1633863678909874176
  - https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465
  - https://twitter.com/_JohnHammond/status/1588155401752788994
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-21
modified: 2023-10-18
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \explorer.exe
      - \dopus.exe
  selection_img:
    - Image|endswith:
        - \EXCEL.EXE
        - \POWERPNT.EXE
        - \WINWORD.exe
    - OriginalFileName:
        - Excel.exe
        - POWERPNT.EXE
        - WinWord.exe
  selection_trusted_location:
    CommandLine|contains:
      - \AppData\Roaming\Microsoft\Templates
      - \AppData\Roaming\Microsoft\Word\Startup\
      - \Microsoft Office\root\Templates\
      - \Microsoft Office\Templates\
  filter_main_dotx:
    CommandLine|endswith:
      - .dotx
      - .xltx
      - .potx
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f99abdf0-6283-4e71-bd2b-b5c048a94743
    type: derived

What it detects

This rule flags process creation where an Office application (EXCEL.EXE, POWERPNT.EXE, or WINWORD.EXE) is executed from a parent shell and its command line indicates a target document located in commonly trusted Office template or Startup directories. Such behavior matters because attackers can use trusted locations to reduce user prompts or security friction while launching malicious document content. The detection relies on Windows process creation telemetry, specifically ParentImage, Image/OriginalFileName, and CommandLine path substrings and extensions.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.