attack.t1204.002

HackTool - LittleCorporal Generated Maldoc Injection

Dec 4, 2023 · attack.execution attack.t1204.002 attack.t1055.003 ·

Detects the process injection of a LittleCorporal generated Maldoc.

Suspicious Binary In User Directory Spawned From Office Application

Dec 1, 2023 · attack.execution attack.t1204.002 attack.g0046 car.2013-05-002 ·

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Suspicious Microsoft Office Child Process - MacOS

Dec 1, 2023 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·

Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Suspicious WmiPrvSE Child Process

Nov 10, 2023 · attack.execution attack.defense_evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·

Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

File With Uncommon Extension Created By An Office Application

Oct 18, 2023 · attack.t1204.002 attack.execution ·

Share on:

Detects the creation of files with an executable or script extension by an Office application.

Suspicious Microsoft Office Child Process

Oct 18, 2023 · attack.defense_evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·

Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Suspicious Outlook Child Process

Oct 18, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects a suspicious process spawning from an Outlook process.

Remote DLL Load Via Rundll32.EXE

Oct 4, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects a remote DLL load event via "rundll32.exe".

New Application in AppCompat

Aug 17, 2023 · attack.execution attack.t1204.002 ·

Share on:

A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.

Droppers Exploiting CVE-2017-11882

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.11882 detection.emerging_threats ·

Share on:

Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Exploit for CVE-2017-0261

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.0261 detection.emerging_threats ·

Share on:

Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Exploit for CVE-2017-8759

Jun 20, 2023 · attack.execution attack.t1203 attack.t1204.002 attack.initial_access attack.t1566.001 cve.2017.8759 detection.emerging_threats ·

Share on:

Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Potential Maze Ransomware Activity

Jun 20, 2023 · attack.execution attack.t1204.002 attack.t1047 attack.impact attack.t1490 detection.emerging_threats ·

Share on:

Detects specific process characteristics of Maze ransomware word document droppers

Download From Suspicious TLD - Blacklist

May 18, 2023 · attack.initial_access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects download of certain file types from hosts in suspicious TLDs

Download From Suspicious TLD - Whitelist

May 18, 2023 · attack.initial_access attack.t1566 attack.execution attack.t1203 attack.t1204.002 ·

Share on:

Detects executable downloads from suspicious remote systems

Microsoft Excel Add-In Loaded From Uncommon Location

May 15, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

File Creation by Office Applications

Apr 21, 2023 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense_evasion ·

Share on:

This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.

Active Directory Kerberos DLL Loaded Via Office Application

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects Kerberos DLL being loaded by an Office Product

Active Directory Parsing DLL Loaded Via Office Application

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects DSParse DLL being loaded by an Office Product

CLR DLL Loaded Via Office Applications

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects CLR DLL being loaded by an Office Product

DotNET Assembly DLL Loaded Via Office Application

Apr 3, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects any assembly DLL being loaded by an Office Product

Suspicious WMIC Execution Via Office Process

Feb 14, 2023 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense_evasion ·

Share on:

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

GAC DLL Loaded Via Office Applications

Feb 9, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects any GAC DLL being loaded by an Office Product

Microsoft VBA For Outlook Addin Loaded Via Outlook

Feb 9, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

VBA DLL Loaded Via Office Application

Feb 9, 2023 · attack.execution attack.t1204.002 ·

Share on:

Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.

Flash Player Update from Suspicious Location

Feb 1, 2023 · attack.initial_access attack.t1189 attack.execution attack.t1204.002 attack.defense_evasion attack.t1036.005 ·

Share on:

Detects a flashplayer update from an unofficial location

Ursnif Malware C2 URL Pattern

Jan 31, 2023 · attack.initial_access attack.t1566.001 attack.execution attack.t1204.002 attack.command_and_control attack.t1071.001 ·

Share on:

Detects Ursnif C2 traffic.

Suspicious User-Initiated Process Execution on External Drive (Old)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Suspicious User-Initiated Process Execution on External Drive (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

File Was Not Allowed To Run

Oct 25, 2022 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·

Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.

ms-msdt for RCE CVE-2022-30190

Jun 2, 2022 · attack.execution attack.T1059.003 attack.T1204.002 ·

Share on:

Detecting the execution of weaponized maldoc or embedded link in outlook that uses ms-msdt scheme to execute code.

ms-msdt for RCE - sdiagnhost.exe spawning command

May 30, 2022 · attack.execution attack.T1059.003 attack.T1204.002 ·

Share on:

Detecting sdiagnhost.exe executing the POC as a result of vulnerability based on ms-msdt.