Windows: .one/.onepkg File Created in Suspicious Locations

Flags creation of OneNote attachment files (.one/.onepkg) in temp/public-style paths on Windows.

FreeUnreviewedSigmamediumv1

windows-one-onepkg-file-created-in-suspicious-locations-7fd164ba

title: "Windows: .one/.onepkg File Created in Suspicious Locations"
id: 12ddc26b-a84e-48f3-ae45-5085a89e9cd9
status: test
description: This rule identifies file creation events where the target filename contains common temporary or public drop paths and ends with .one or .onepkg. Attackers can use OneNote attachment file formats as a delivery mechanism and stage these files in locations often associated with transient payload drops. The detection relies on Windows file event telemetry that includes the created filename/path and the creating process image path for exclusion when it matches ONENOTE.EXE under Microsoft Office Program Files.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
  - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
modified: 2023-09-19
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - \AppData\Local\Temp\
      - \Users\Public\
      - \Windows\Temp\
      - :\Temp\
    TargetFilename|endswith:
      - .one
      - .onepkg
  filter_main_onenote:
    Image|contains: :\Program Files\Microsoft Office\
    Image|endswith: \ONENOTE.EXE
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate usage of ".one" or ".onepkg" files from those locations
level: medium
license: DRL-1.1
related:
  - id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0
    type: derived

What it detects

This rule identifies file creation events where the target filename contains common temporary or public drop paths and ends with .one or .onepkg. Attackers can use OneNote attachment file formats as a delivery mechanism and stage these files in locations often associated with transient payload drops. The detection relies on Windows file event telemetry that includes the created filename/path and the creating process image path for exclusion when it matches ONENOTE.EXE under Microsoft Office Program Files.

Known false positives

Legitimate usage of ".one" or ".onepkg" files from those locations

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.