Windows Office Macro File Creation Triggered by Script/Execution Binaries

title: Windows Office Macro File Creation Triggered by Script/Execution Binaries
id: 506e2c91-0120-4dfb-b352-116c383d9b63
status: test
description: This rule flags file creation events where an Office macro-enabled document or template is written with extensions such as .docm, .xlsm, .pptm, and related types. It specifically looks for activity initiated by common script execution binaries (cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, wscript.exe) based on the Image and ParentImage ending paths. This matters because attackers often use these components to generate or stage Office macro files for subsequent execution. The detection relies on Windows file event telemetry with process Image information and (optionally) ParentImage enrichment for broader coverage.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-23
modified: 2023-02-22
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
  definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data'
detection:
  selection_cmd:
    - Image|endswith:
        - \cscript.exe
        - \mshta.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
    - ParentImage|endswith:
        - \cscript.exe
        - \mshta.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \wscript.exe
  selection_ext:
    TargetFilename|endswith:
      - .docm
      - .dotm
      - .xlsm
      - .xltm
      - .potm
      - .pptm
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b1c50487-1967-4315-a026-6491686d860e
    type: derived