Windows Suspicious EXE in User Directory Launched by Microsoft Office Applications

Alert on Office spawning a .exe from C:\users\ (except when the child is Teams.exe).

FreeUnreviewedSigmahighv1

windows-suspicious-exe-in-user-directory-launched-by-microsoft-office-applicatio-aa3a6f94

title: Windows Suspicious EXE in User Directory Launched by Microsoft Office Applications
id: ca269059-28e7-452a-a411-cf92308eff22
status: test
description: This rule flags process executions where an Office application (Word, Excel, PowerPoint, Publisher, Visio, Access, or Equation Editor) starts an executable located under the user directory (C:\users\) that ends with .exe. Such behavior matters because it can indicate user-writable execution paths used to run malware or unauthorized payloads from Office-launched processes. It relies on Windows process creation telemetry, specifically the parent process image and the child process image path.
references:
  - https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign
  - https://www.virustotal.com/gui/file/23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_spawn_exe_from_users_directory.yml
author: Jason Lynch, Huntrule Team
date: 2019-04-02
modified: 2023-02-04
tags:
  - attack.execution
  - attack.t1204.002
  - attack.g0046
  - car.2013-05-002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \WINWORD.EXE
      - \EXCEL.EXE
      - \POWERPNT.exe
      - \MSPUB.exe
      - \VISIO.exe
      - \MSACCESS.exe
      - \EQNEDT32.exe
    Image|startswith: C:\users\
    Image|endswith: .exe
  filter:
    Image|endswith: \Teams.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: aa3a6f94-890e-4e22-b634-ffdfd54792cc
    type: derived

What it detects

This rule flags process executions where an Office application (Word, Excel, PowerPoint, Publisher, Visio, Access, or Equation Editor) starts an executable located under the user directory (C:\users\) that ends with .exe. Such behavior matters because it can indicate user-writable execution paths used to run malware or unauthorized payloads from Office-launched processes. It relies on Windows process creation telemetry, specifically the parent process image and the child process image path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.