Windows Office Startup Folder File Creation with Uncommon Extension

Detects unusual-extension files created in Word/Excel startup folders on Windows, potentially supporting automatic Office loading.

FreeUnreviewedSigmahighv1

windows-office-startup-folder-file-creation-with-uncommon-extension-a10a2c40

title: Windows Office Startup Folder File Creation with Uncommon Extension
id: 40b86648-225c-4036-b1f2-ce27a1991c5a
status: test
description: This rule flags file creation events in Microsoft Word or Excel startup directories when the created file has an extension the rule does not consider commonly used for those apps. Placing files in Office startup folders can enable attacker-controlled files to be loaded automatically when the user runs Office, making unusual extensions in these locations a high-signal anomaly. It relies on Windows file event telemetry that includes the target filename path and the creating process image path to confirm the activity is associated with Office or Click-to-Run binaries.
references:
  - https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/
  - http://addbalance.com/word/startup.htm
  - https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3
  - https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-05
modified: 2023-12-13
tags:
  - attack.resource-development
  - attack.t1587.001
logsource:
  product: windows
  category: file_event
detection:
  selection_word_paths:
    - TargetFilename|contains: \Microsoft\Word\STARTUP
    - TargetFilename|contains|all:
        - \Office
        - \Program Files
        - \STARTUP
  filter_exclude_word_ext:
    TargetFilename|endswith:
      - .docb
      - .docm
      - .docx
      - .dotm
      - .mdb
      - .mdw
      - .pdf
      - .wll
      - .wwl
  selection_excel_paths:
    - TargetFilename|contains: \Microsoft\Excel\XLSTART
    - TargetFilename|contains|all:
        - \Office
        - \Program Files
        - \XLSTART
  filter_exclude_excel_ext:
    TargetFilename|endswith:
      - .xll
      - .xls
      - .xlsm
      - .xlsx
      - .xlt
      - .xltm
      - .xlw
  filter_main_office_click_to_run:
    Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\
    Image|endswith: \OfficeClickToRun.exe
  filter_main_office_apps:
    Image|contains:
      - :\Program Files\Microsoft Office\
      - :\Program Files (x86)\Microsoft Office\
    Image|endswith:
      - \winword.exe
      - \excel.exe
  condition: ((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_*
falsepositives:
  - False positive might stem from rare extensions used by other Office utilities.
level: high
license: DRL-1.1
related:
  - id: a10a2c40-2c4d-49f8-b557-1a946bc55d9d
    type: derived

What it detects

This rule flags file creation events in Microsoft Word or Excel startup directories when the created file has an extension the rule does not consider commonly used for those apps. Placing files in Office startup folders can enable attacker-controlled files to be loaded automatically when the user runs Office, making unusual extensions in these locations a high-signal anomaly. It relies on Windows file event telemetry that includes the target filename path and the creating process image path to confirm the activity is associated with Office or Click-to-Run binaries.

Known false positives

False positive might stem from rare extensions used by other Office utilities.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.