Windows: OneNote .one/.onepkg File Creation in Suspicious Locations
Flags creation of OneNote attachment files (.one/.onepkg) in temp/public-style paths on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-22
- Updated
- 2026-07-31
What it detects
This rule flags creation of files ending in .one or .onepkg within uncommon or potentially risky Windows paths, including temporary and public directories. Attackers can abuse OneNote attachment file types to stage payloads or support malicious delivery workflows, making unexpected drops in these locations noteworthy. The detection relies on file creation telemetry including target file paths and the creating process image path to exclude a common legitimate OneNote process origin.
Reporting behind it
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
- blog.osarmor.comhttps://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-one-onepkg-file-created-in-suspicious-locations-7fd164ba
title: "Windows: OneNote .one/.onepkg File Creation in Suspicious Locations"
id: 12ddc26b-a84e-48f3-ae45-5085a89e9cd9
status: test
description: This rule flags creation of files ending in .one or .onepkg within uncommon or potentially risky Windows paths, including temporary and public directories. Attackers can abuse OneNote attachment file types to stage payloads or support malicious delivery workflows, making unexpected drops in these locations noteworthy. The detection relies on file creation telemetry including target file paths and the creating process image path to exclude a common legitimate OneNote process origin.
references:
- https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
- https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
modified: 2023-09-19
tags:
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \AppData\Local\Temp\
- \Users\Public\
- \Windows\Temp\
- :\Temp\
TargetFilename|endswith:
- .one
- .onepkg
filter_main_onenote:
Image|contains: :\Program Files\Microsoft Office\
Image|endswith: \ONENOTE.EXE
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate usage of ".one" or ".onepkg" files from those locations
level: medium
license: DRL-1.1
related:
- id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0
type: derived