Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts

Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.

FreeUnreviewedSigmahighv1

windows-onenote-exe-launches-cmd-cscript-mshta-powershell-wscript-with-onenote-e-84b1706c

title: Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts
id: 734f89ef-6cf9-4601-bb07-b46bc17218cf
status: test
description: This rule flags process creation events where OneNote.exe launches command-line scripting or script-hosting binaries (cmd.exe, cscript.exe, mshta.exe, PowerShell, pwsh, wscript.exe) with paths indicating OneNote-exported or OneNote offline cache script content. Attackers commonly use malicious OneNote attachments to cause exported embedded content to be executed through these interpreters, enabling stealthy code execution from user interaction. The detection relies on Windows process creation telemetry, specifically the parent process name, child image name, and command-line path fragments such as exported and onenote offline cache directories.
references:
  - https://bazaar.abuse.ch/browse/tag/one/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_onenote_embedded_script_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2023-02-02
tags:
  - attack.stealth
  - attack.t1218.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \onenote.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    CommandLine|contains:
      - \exported\
      - \onenoteofflinecache_files\
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 84b1706c-932a-44c4-ae28-892b28a25b94
    type: derived

What it detects

This rule flags process creation events where OneNote.exe launches command-line scripting or script-hosting binaries (cmd.exe, cscript.exe, mshta.exe, PowerShell, pwsh, wscript.exe) with paths indicating OneNote-exported or OneNote offline cache script content. Attackers commonly use malicious OneNote attachments to cause exported embedded content to be executed through these interpreters, enabling stealthy code execution from user interaction. The detection relies on Windows process creation telemetry, specifically the parent process name, child image name, and command-line path fragments such as exported and onenote offline cache directories.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.