Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line
Flags Windows command-line downloads using curl/wget or PowerShell from Outlook/OneNote attachment domains.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-27
- Updated
- 2026-07-30
ATT&CK techniques
Resource Dev → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Windows process executions that use common download utilities or PowerShell download commands to fetch content from Microsoft Outlook/OneNote attachment-related domains. Attackers often rely on these legitimate cloud endpoints to retrieve malicious payloads while blending in with normal email or document workflows. It relies on process creation telemetry including the executable name (curl.exe/wget.exe) and command-line contents containing specific download keywords and the targeted attachment URLs.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line
id: 41d140dd-69d6-4f37-9ee8-31c7b1512d19
status: test
description: This rule identifies Windows process executions that use common download utilities or PowerShell download commands to fetch content from Microsoft Outlook/OneNote attachment-related domains. Attackers often rely on these legitimate cloud endpoints to retrieve malicious payloads while blending in with normal email or document workflows. It relies on process creation telemetry including the executable name (curl.exe/wget.exe) and command-line contents containing specific download keywords and the targeted attachment URLs.
references:
- https://twitter.com/an0n_r0/status/1474698356635193346?s=12
- https://twitter.com/mrd0x/status/1475085452784844803?s=12
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-27
modified: 2022-08-02
tags:
- attack.command-and-control
- attack.resource-development
- attack.t1105
- attack.t1608
logsource:
product: windows
category: process_creation
detection:
selection_download:
- Image|endswith:
- \curl.exe
- \wget.exe
- CommandLine|contains:
- Invoke-WebRequest
- "iwr "
- "curl "
- "wget "
- Start-BitsTransfer
- .DownloadFile(
- .DownloadString(
selection_domains:
CommandLine|contains:
- https://attachment.outlook.live.net/owa/
- https://onenoteonlinesync.onenote.com/onenoteonlinesync/
condition: all of selection_*
falsepositives:
- Scripts or tools that download attachments from these domains (OneNote, Outlook 365)
level: high
license: DRL-1.1
related:
- id: 00d49ed5-4491-4271-a8db-650a4ef6f8c1
type: derived