Attachment: Malicious OneNote Commands

calendar Aug 21, 2023  ยท
Share on: linkedin copy

Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.

Sublime rule (View on GitHub)

 1name: "Attachment: Malicious OneNote Commands"
 2description: |
 3    Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.
 4references:
 5  - "https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/"
 6  - "https://bazaar.abuse.ch/sample/aafc0ca9681c1f5c368b0f6da85b90e433f6d62fb34ed2e968e53f83981a800f"
 7type: "rule"
 8authors:
 9  - twitter: "Kyle_Parrish_"
10    name: "Kyle Parrish"
11severity: "high"
12source: |
13  type.inbound
14  and any(attachments,
15          (.file_extension in~ ("one") or .file_extension in~ $file_extensions_common_archives)
16          and any(file.explode(.),
17                  "onenote_file" in .flavors.yara
18                  and any(.scan.strings.strings,
19                          strings.ilike(.,
20                                        "*WshShell*",
21                                        "*ExecuteCmdAsync*",
22                                        "*CreateObject*",
23                                        "*Wscript.Shell*",
24                                        "*schtasks*",
25                                        "*CreateProcess*",
26                                        "*winmgmts*",
27                                        "*SetEnvironmentVariable*",
28                                        "*powershell*",
29                                        "*echo off*"
30                          )
31                  )
32          )
33  )  
34attack_types:
35  - "Malware/Ransomware"
36tactics_and_techniques:
37  - "OneNote"
38  - "Scripting"
39detection_methods:
40  - "Archive analysis"
41  - "Content analysis"
42  - "File analysis"
43  - "YARA"
44id: "7319f0eb-a3c7-5320-a4ae-6fbf7952369e"
to-top