Attachment: Malicious OneNote commands

 1name: "Attachment: Malicious OneNote commands"
 2description: |
 3    Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.
 4references:
 5  - "https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/"
 6  - "https://bazaar.abuse.ch/sample/aafc0ca9681c1f5c368b0f6da85b90e433f6d62fb34ed2e968e53f83981a800f"
 7type: "rule"
 8authors:
 9  - twitter: "Kyle_Parrish_"
10    name: "Kyle Parrish"
11severity: "high"
12source: |
13  type.inbound
14  and any(attachments,
15          (
16            .file_extension in~ ("one")
17            or .file_extension in~ $file_extensions_common_archives
18          )
19          and any(file.explode(.),
20                  "onenote_file" in .flavors.yara
21                  and any(.scan.strings.strings,
22                          strings.ilike(.,
23                                        "*WshShell*",
24                                        "*ExecuteCmdAsync*",
25                                        "*CreateObject*",
26                                        "*Wscript.Shell*",
27                                        "*schtasks*",
28                                        "*CreateProcess*",
29                                        "*winmgmts*",
30                                        "*SetEnvironmentVariable*",
31                                        "*powershell*",
32                                        "*echo off*"
33                          )
34                  )
35          )
36  )  
37attack_types:
38  - "Malware/Ransomware"
39tactics_and_techniques:
40  - "OneNote"
41  - "Scripting"
42detection_methods:
43  - "Archive analysis"
44  - "Content analysis"
45  - "File analysis"
46  - "YARA"
47id: "7319f0eb-a3c7-5320-a4ae-6fbf7952369e"