Windows Process Injection Triggered by winword.exe from LittleCorporal Maldoc

title: Windows Process Injection Triggered by winword.exe from LittleCorporal Maldoc
id: 06f1741f-aa9f-4381-9681-f398becbac45
status: test
description: This rule identifies process injection behavior where the source process is winword.exe and the call trace indicates execution consistent with a LittleCorporal-generated Maldoc. Attackers use document-based delivery combined with injection to run malicious code inside a trusted Office process to improve stealth and evade defenses. The detection relies on process access telemetry including SourceImage and detailed CallTrace matching patterns.
references:
  - https://github.com/connormcgarr/LittleCorporal
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_littlecorporal_generated_maldoc.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-08-09
modified: 2023-11-28
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1204.002
  - attack.t1055.003
logsource:
  category: process_access
  product: windows
detection:
  selection:
    SourceImage|endswith: \winword.exe
    CallTrace|contains|all:
      - :\Windows\Microsoft.NET\Framework64\v2.
      - UNKNOWN
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7bdde3bf-2a42-4c39-aa31-a92b3e17afac
    type: derived