Windows Office Macro File Creation via Browser or Email Client

Flags Windows creation of macro-enabled Office files (.docm/.xlsm/.pptm) initiated by common browsers or email clients.

FreeUnreviewedSigmalowv1

windows-office-macro-file-creation-via-browser-or-email-client-0e29e3a7

title: Windows Office Macro File Creation via Browser or Email Client
id: 9052bbe4-5000-4314-99f2-3b6597bdf932
related:
  - id: 91174a41-dc8f-401b-be89-7bfc140612a0
    type: similar
  - id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
    type: derived
status: test
description: This rule identifies creation or download of macro-enabled Office documents on Windows when initiated by a browser or mail client process. It helps surface initial-access activity where attackers deliver macro-capable files for later exploitation. The detection relies on file event telemetry that records the creating process and the target filename, focusing on .docm, .dotm, .xlsm, .xltm, .potm, and .pptm patterns including zone-marking indicators.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_macro_files_downloaded.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-23
modified: 2025-10-29
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_processes:
    Image|endswith:
      - \RuntimeBroker.exe
      - \outlook.exe
      - \thunderbird.exe
      - \brave.exe
      - \chrome.exe
      - \firefox.exe
      - \iexplore.exe
      - \maxthon.exe
      - \MicrosoftEdge.exe
      - \msedge.exe
      - \msedgewebview2.exe
      - \opera.exe
      - \safari.exe
      - \seamonkey.exe
      - \vivaldi.exe
      - \whale.exe
  selection_ext:
    - TargetFilename|endswith:
        - .docm
        - .dotm
        - .xlsm
        - .xltm
        - .potm
        - .pptm
    - TargetFilename|contains:
        - .docm:Zone
        - .dotm:Zone
        - .xlsm:Zone
        - .xltm:Zone
        - .potm:Zone
        - .pptm:Zone
  condition: all of selection_*
falsepositives:
  - Legitimate macro files downloaded from the internet
  - Legitimate macro files sent as attachments via emails
level: low
license: DRL-1.1

What it detects

This rule identifies creation or download of macro-enabled Office documents on Windows when initiated by a browser or mail client process. It helps surface initial-access activity where attackers deliver macro-capable files for later exploitation. The detection relies on file event telemetry that records the creating process and the target filename, focusing on .docm, .dotm, .xlsm, .xltm, .potm, and .pptm patterns including zone-marking indicators.

Known false positives

Legitimate macro files downloaded from the internet
Legitimate macro files sent as attachments via emails

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.