Windows Office macro file creation (.docm/.xlsm/.pptm) by Microsoft Office executables

Alerts on creation of macro-enabled Office documents/templates by Office apps on Windows, excluding Office temporary files.

FreeUnreviewedSigmalowv1

windows-office-macro-file-creation-docm-xlsm-pptm-by-microsoft-office-executable-91174a41

title: Windows Office macro file creation (.docm/.xlsm/.pptm) by Microsoft Office executables
id: 20129d54-8875-4b77-8dbf-e795d03fdcbf
related:
  - id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
    type: similar
  - id: 91174a41-dc8f-401b-be89-7bfc140612a0
    type: derived
status: test
description: This rule flags file creation events where the target filename ends with common Office macro-enabled extensions such as .docm, .xlsm, .pptm, and related template/add-in formats. It further constrains activity to files created by Microsoft Office application executables (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) and excludes temporary Office files that include ~$. Monitoring this matters because macro-enabled document creation can indicate staging or preparation for execution of malicious Office content, and the rule relies on Windows file event telemetry containing the created file path/name and the creating process image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_macro_files_created.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-23
modified: 2026-01-09
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - .docm
      - .dotm
      - .xlsm
      - .xltm
      - .potm
      - .pptm
  filter_main_office:
    Image|startswith:
      - C:\Program Files\Microsoft Office\
      - C:\Program Files (x86)\Microsoft Office\
    Image|endswith:
      - \WINWORD.EXE
      - \EXCEL.EXE
      - \POWERPNT.EXE
    TargetFilename|contains: \~$
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Very common in environments that rely heavily on macro documents
level: low
license: DRL-1.1

What it detects

This rule flags file creation events where the target filename ends with common Office macro-enabled extensions such as .docm, .xlsm, .pptm, and related template/add-in formats. It further constrains activity to files created by Microsoft Office application executables (WINWORD.EXE, EXCEL.EXE, POWERPNT.EXE) and excludes temporary Office files that include ~$. Monitoring this matters because macro-enabled document creation can indicate staging or preparation for execution of malicious Office content, and the rule relies on Windows file event telemetry containing the created file path/name and the creating process image path.

Known false positives

Very common in environments that rely heavily on macro documents

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.