Windows Office Macro File Creation Triggered by Script/LOLBin Parent Process
Alerts when macro-enabled Office files are created by common Windows script execution processes.
- Product
- windows
- Category
- file_event
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-23
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of Office macro-enabled files (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) when the initiating process image ends with common script execution or proxy binary names (cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, wscript.exe). Such activity matters because attackers frequently generate or drop macro-capable documents as part of initial access and payload delivery. The detection relies on Windows file event telemetry that includes the process image and, where available, a ParentImage field to attribute the file creation to the suspicious parent process.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Office Macro File Creation Triggered by Script/LOLBin Parent Process
id: 506e2c91-0120-4dfb-b352-116c383d9b63
status: test
description: This rule flags creation of Office macro-enabled files (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) when the initiating process image ends with common script execution or proxy binary names (cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, wscript.exe). Such activity matters because attackers frequently generate or drop macro-capable documents as part of initial access and payload delivery. The detection relies on Windows file event telemetry that includes the process image and, where available, a ParentImage field to attribute the file creation to the suspicious parent process.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
- https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-23
modified: 2023-02-22
tags:
- attack.initial-access
- attack.t1566.001
logsource:
category: file_event
product: windows
definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data'
detection:
selection_cmd:
- Image|endswith:
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
- ParentImage|endswith:
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
selection_ext:
TargetFilename|endswith:
- .docm
- .dotm
- .xlsm
- .xltm
- .potm
- .pptm
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: b1c50487-1967-4315-a026-6491686d860e
type: derived