Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts
Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2023-02-02
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where OneNote.exe launches command-line scripting or script-hosting binaries (cmd.exe, cscript.exe, mshta.exe, PowerShell, pwsh, wscript.exe) with paths indicating OneNote-exported or OneNote offline cache script content. Attackers commonly use malicious OneNote attachments to cause exported embedded content to be executed through these interpreters, enabling stealthy code execution from user interaction. The detection relies on Windows process creation telemetry, specifically the parent process name, child image name, and command-line path fragments such as exported and onenote offline cache directories.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts
id: 734f89ef-6cf9-4601-bb07-b46bc17218cf
status: test
description: This rule flags process creation events where OneNote.exe launches command-line scripting or script-hosting binaries (cmd.exe, cscript.exe, mshta.exe, PowerShell, pwsh, wscript.exe) with paths indicating OneNote-exported or OneNote offline cache script content. Attackers commonly use malicious OneNote attachments to cause exported embedded content to be executed through these interpreters, enabling stealthy code execution from user interaction. The detection relies on Windows process creation telemetry, specifically the parent process name, child image name, and command-line path fragments such as exported and onenote offline cache directories.
references:
- https://bazaar.abuse.ch/browse/tag/one/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_onenote_embedded_script_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2023-02-02
tags:
- attack.stealth
- attack.t1218.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \onenote.exe
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
CommandLine|contains:
- \exported\
- \onenoteofflinecache_files\
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 84b1706c-932a-44c4-ae28-892b28a25b94
type: derived