Windows: OneNote .one/.onepkg File Creation in Suspicious Locations

title: "Windows: OneNote .one/.onepkg File Creation in Suspicious Locations"
id: 12ddc26b-a84e-48f3-ae45-5085a89e9cd9
status: test
description: This rule flags creation of files ending in .one or .onepkg within uncommon or potentially risky Windows paths, including temporary and public directories. Attackers can abuse OneNote attachment file types to stage payloads or support malicious delivery workflows, making unexpected drops in these locations noteworthy. The detection relies on file creation telemetry including target file paths and the creating process image path to exclude a common legitimate OneNote process origin.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
  - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-22
modified: 2023-09-19
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - \AppData\Local\Temp\
      - \Users\Public\
      - \Windows\Temp\
      - :\Temp\
    TargetFilename|endswith:
      - .one
      - .onepkg
  filter_main_onenote:
    Image|contains: :\Program Files\Microsoft Office\
    Image|endswith: \ONENOTE.EXE
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate usage of ".one" or ".onepkg" files from those locations
level: medium
license: DRL-1.1
related:
  - id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0
    type: derived