Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line

title: Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line
id: 41d140dd-69d6-4f37-9ee8-31c7b1512d19
status: test
description: This rule identifies Windows process executions that use common download utilities or PowerShell download commands to fetch content from Microsoft Outlook/OneNote attachment-related domains. Attackers often rely on these legitimate cloud endpoints to retrieve malicious payloads while blending in with normal email or document workflows. It relies on process creation telemetry including the executable name (curl.exe/wget.exe) and command-line contents containing specific download keywords and the targeted attachment URLs.
references:
  - https://twitter.com/an0n_r0/status/1474698356635193346?s=12
  - https://twitter.com/mrd0x/status/1475085452784844803?s=12
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-27
modified: 2022-08-02
tags:
  - attack.command-and-control
  - attack.resource-development
  - attack.t1105
  - attack.t1608
logsource:
  product: windows
  category: process_creation
detection:
  selection_download:
    - Image|endswith:
        - \curl.exe
        - \wget.exe
    - CommandLine|contains:
        - Invoke-WebRequest
        - "iwr "
        - "curl "
        - "wget "
        - Start-BitsTransfer
        - .DownloadFile(
        - .DownloadString(
  selection_domains:
    CommandLine|contains:
      - https://attachment.outlook.live.net/owa/
      - https://onenoteonlinesync.onenote.com/onenoteonlinesync/
  condition: all of selection_*
falsepositives:
  - Scripts or tools that download attachments from these domains (OneNote, Outlook 365)
level: high
license: DRL-1.1
related:
  - id: 00d49ed5-4491-4271-a8db-650a4ef6f8c1
    type: derived