Windows: Office Executable Running a Document from Trusted Template/Startup Paths
Alerts when Office apps are launched with command lines pointing to documents under Office template/Startup paths.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-21
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where an Office application (EXCEL.EXE, POWERPNT.EXE, or WINWORD.EXE) is executed from a parent shell and its command line indicates a target document located in commonly trusted Office template or Startup directories. Such behavior matters because attackers can use trusted locations to reduce user prompts or security friction while launching malicious document content. The detection relies on Windows process creation telemetry, specifically ParentImage, Image/OriginalFileName, and CommandLine path substrings and extensions.
Reporting behind it
- Internal ResearchInternal Research
- twitter.comhttps://twitter.com/Max_Mal_/status/1633863678909874176
- techcommunity.microsoft.comhttps://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465
- twitter.comhttps://twitter.com/_JohnHammond/status/1588155401752788994
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Office Executable Running a Document from Trusted Template/Startup Paths"
id: a2b74830-96d9-4f4c-a2ba-96ef88f37cff
status: test
description: This rule flags process creation where an Office application (EXCEL.EXE, POWERPNT.EXE, or WINWORD.EXE) is executed from a parent shell and its command line indicates a target document located in commonly trusted Office template or Startup directories. Such behavior matters because attackers can use trusted locations to reduce user prompts or security friction while launching malicious document content. The detection relies on Windows process creation telemetry, specifically ParentImage, Image/OriginalFileName, and CommandLine path substrings and extensions.
references:
- Internal Research
- https://twitter.com/Max_Mal_/status/1633863678909874176
- https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465
- https://twitter.com/_JohnHammond/status/1588155401752788994
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-21
modified: 2023-10-18
tags:
- attack.stealth
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \explorer.exe
- \dopus.exe
selection_img:
- Image|endswith:
- \EXCEL.EXE
- \POWERPNT.EXE
- \WINWORD.exe
- OriginalFileName:
- Excel.exe
- POWERPNT.EXE
- WinWord.exe
selection_trusted_location:
CommandLine|contains:
- \AppData\Roaming\Microsoft\Templates
- \AppData\Roaming\Microsoft\Word\Startup\
- \Microsoft Office\root\Templates\
- \Microsoft Office\Templates\
filter_main_dotx:
CommandLine|endswith:
- .dotx
- .xltx
- .potx
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f99abdf0-6283-4e71-bd2b-b5c048a94743
type: derived