Windows Process Access: verclsid.exe Receiving Shellcode Injection from Microsoft Office/VBA

title: "Windows Process Access: verclsid.exe Receiving Shellcode Injection from Microsoft Office/VBA"
id: da8b33f7-38ba-4acf-ae6c-ebe34d49e85a
status: test
description: This rule alerts when a process opens verclsid.exe with broad access rights indicative of code injection. It correlates that access with a call stack containing VBE7.DLL and a source process path consistent with Microsoft Office execution, such as VBA macros. The detection relies on Windows process access telemetry, including TargetImage, GrantedAccess, SourceImage, and call trace strings.
references:
  - https://twitter.com/JohnLaTwC/status/837743453039534080
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Malware/Hancitor/proc_access_win_malware_verclsid_shellcode.yml
author: John Lambert (tech), Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-04
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.emerging-threats
logsource:
  category: process_access
  product: windows
  definition: 'Requirements: The following config is required to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
detection:
  selection_target:
    TargetImage|endswith: \verclsid.exe
    GrantedAccess: "0x1FFFFF"
  selection_calltrace_1:
    CallTrace|contains|all:
      - "|UNKNOWN("
      - VBE7.DLL
  selection_calltrace_2:
    SourceImage|contains: \Microsoft Office\
    CallTrace|contains: "|UNKNOWN"
  condition: selection_target and 1 of selection_calltrace_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b7967e22-3d7e-409b-9ed5-cdae3f9243a1
    type: derived