Suspicious File Dropped by a Macro Enabled Document

[rule]
description = """
Identifies when a Microsoft Office process writes an executable file type and from a call stack pointing to Microsoft
Office Visual Basic for Applications modules. This may indicate an attempt to get initial access using malicious macro
enabled documents.
"""
id = "9eca0b31-cf47-4120-afe9-9badb0c308e0"
license = "Elastic License v2"
name = "Suspicious File Dropped by a Macro Enabled Document"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.22"

query = '''
file where event.action != "deletion" and event.action != "open" and
   process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "mspub.exe", "fltldr.exe", "visio.exe") and
   process.thread.Ext.call_stack_summary : "*|vbe?.dll*" and
   (file.extension : ("exe", "pif", "scr", "iso", "rar", "7z", "img", "vhd", "js", "vbs", "wsh", "hta", "cpl", "jse", "vbe", "bat", "cmd", "dll") or
    file.Ext.header_bytes : ("4d5a*", "TVqQ*", "406563686F*", "3c736372697074206c616e6775616765", "76617220*")) and
   not (file.extension == "zip" and file.Ext.header_bytes == "504b0506000000000000000000000000")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "8.7.0"