Execution from a Macro Enabled Office Document

[rule]
description = """
Identifies when a Microsoft Office process spawns a child process and from a call stack pointing to Microsoft Office
Visual Basic for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled
documents.
"""
id = "1c4047ca-a69b-473f-a93e-5660e012d9a5"
license = "Elastic License v2"
name = "Execution from a Macro Enabled Office Document"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.32"

query = '''
process where event.action == "start" and
   process.parent.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "mspub.exe", "fltldr.exe", "visio.exe") and
   process.parent.thread.Ext.call_stack_summary : "*|VBE?.dll*" and process.executable : "C:\\*" and

   not (process.executable : "?:\\Windows\\splwow64.exe" and
        _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Windows\\Sys*\\winspool.drv*")) and

   not (process.executable : "?:\\Program Files*\\Microsoft Office\\root\\Office*\\MSACCESS.EXE" and
         process.parent.name : "MSACCESS.EXE" and
        _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\Program Files*\\Microsoft Office\\root\\Office*\\MSACCESS.EXE!FDeliverDb*")) and

   not (process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
        not process.code_signature.subject_name : "Microsoft*") and

   not (process.name : "rundll32.exe" and process.args : ("?:\\WINDOWS\\system32\\spool\\DRIVERS\\*MonitorPrintJobStatus", "url.dll,FileProtocolHandler")) and

   not (process.command_line : "powershell.exe -WindowStyle hidden kill -processname winword" and process.working_directory : "\\\\*$\\*\\Documents\\") and

   not process.hash.sha256 : ("3d4926dbf5c4fc8edd3382850cdd54fc5b4e866b34251f7cff5ba0b50179dedb",
                              "bf879ebb625dbc1d2561e5aa6d9bb3bf16ad1d834743456568ec40dddace6fb0",
                              "0697a5a9fecac88cd1a875f32ebbb5fecefdcdc9ddd3e1c17e391527abf47aa0",
                              "5fa6ed1524d60215307f7c84df56f1fa8c852321df1fe0931521c76cbb6d6821",
                              "be4d0288c69fba437e369110f27cbc4f5448bb7c3d2fe204c6ea8a053f426620",
                              "ee8141ceae149b3b2f1fb89bfea36d287b2157b9279377b318fdaf717158eaf1",
                              "4659ad634dce7b746929590173abbf341a456042d5a70acce462f7806c859d01",
                              "a892c32f9c80f15716cff118a1287036c4c6d4b18ca81b0141f353bffd662134",
                              "c568d3dd471f06d0d38b711efb04a1d6fba11bc87522aeb58b42267f5e04af89",
                              "71bd6fd7d83af510485abe2f400311600dd8432a70ecb767c352ee6b3675ebc2",
                              "197dd5559e979df757312a5235f453eb71c7b80d4229bce1720f57c1c8b19ab9",
                              "993a81cbaa686eb56997e5bd49f0e348166a4ffbf86001f589f73939778b3baa",
                              "280c6e19e80864faf90dd97905aacf999f58778a5adac1a8ee06477c6f80fb65",
                              "1037f978350bb4b52c8698b81d0a377675c98d0ca9a82070174cc0f46e8cb51e",
                              "83b5a19f2df77b735069a4f9f1def9c0e207f8636bdd6856ef52977bc23f874b",
                              "d248007eb375cab3994b48ba1346b508de29d1f441a395b9e6fa14fc7913294d",
                              "bf3a8aa99f62748edb9c7921c50778bff5dd0f4d47f7a1263516e10b99903a28",
                              "ce4a8d8ebe5bcb5ba5ee9a6733bbd6c06433d3fc3a14aef95065689ca06bff06",
                              "dda38aee1ada246114121c82df7441c3b4a7c0b27767a4ea8781623f5ee5df02",
                              "24a7d85e2b983037985d6dbaa9befd3b48e08ed9bbbe6b242501a250776ec6bc",
                              "5d4cb2c29245c7c12df3d3a7609ed4b7f24d47c991758c2f73c5131c2be53d03",
                              "d6236f9ea1a7f98008fc03a761c5373badb79dc70a5e9e17e11f1302d405e011") and

   not process.executable : ("?:\\Windows\\explorer.exe",
                             "?:\\Windows\\SysWOW64\\explorer.exe",
                             "?:\\Windows\\SysWOW64\\cmd.exe",
                             "?:\\Windows\\System32\\cmd.exe",
                             "C:\\Windows\\SysWOW64\\cmd.exe",
                             "?:\\Windows\\hh.exe",
                             "?:\\Windows\\System32\\spool\\drivers\\*",
                             "?:\\Program Files (x86)\\Microsoft Office\\root\\*.EXE",
                             "?:\\Program Files\\Microsoft Office\\root\\*.EXE",
                             "?:\\Program Files (x86)\\AV\\AV.EXE",
                             "?:\\Program Files\\AV\\AV.EXE",
                             "?:\\Program Files (x86)\\PDFtk\\bin\\pdftk.exe",
                             "?:\\Program Files\\PDFtk\\bin\\pdftk.exe",
                             "?:\\Windows\\SysWOW64\\DWWIN.EXE",
                             "?:\\WINDOWS\\system32\\dwwin.exe",
                             "?:\\Windows\\System32\\wermgr.exe",
                             "?:\\Windows\\SysWOW64\\wermgr.exe",
                             "?:\\Windows\\System32\\taskkill.exe",
                             "?:\\Windows\\System32\\Robocopy.exe",
                             "C:\\Windows\\SysWOW64\\verclsid.exe",
                             "C:\\Program Files\\Microsoft VS Code\\Code.exe",
                             "\\Device\\Mup\\*",
                             "?:\\Program Files\\Common Files\\microsoft shared\\DW\\DW20.EXE",
                             "?:\\Program Files (x86)\\Common Files\\Microsoft Shared\\DW\\DW20.EXE",
                             "?:\\Program Files (x86)\\DivorceMate Software\\DIVORCEmate.exe",
                             "?:\\Program Files (x86)\\DivorceMate Software\\dmFile.exe",
                             "?:\\Program Files (x86)\\Efalia GmbH\\Efalia ECM WinClient\\DSDMS.FileDirector.WinClient.exe",
                             "?:\\Program Files (x86)\\Spielberg Solutions GmbH\\FileDirector WinClient\\DSDMS.FileDirector.WinClient.exe",
                             "?:\\Windows\\Microsoft.NET\\Framework*\\csc.exe",
                             "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                             "?:\\Program Files\\Internet Explorer\\iexplore.exe",
                             "?:\\Program Files\\7-Zip\\7z.exe",
                             "?:\\Program Files (x86)\\Microsoft Office\\Office??\\MsoSync.exe",
                             "C:\\Program Files\\WindowsApps\\Microsoft.WindowsNotepad_*\\Notepad\\Notepad.exe",
                             "?:\\Windows\\SysWOW64\\taskkill.exe",
                             "?:\\Windows\\System32\\WerFault.exe")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "8.7.0"