Suspicious Microsoft Office Child Process

[rule]
description = """
Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel).
These child processes are often launched during exploitation of Office applications or from documents with malicious
macros.
"""
id = "c34a9dca-66cf-4283-944d-1800b28ae690"
license = "Elastic License v2"
name = "Suspicious Microsoft Office Child Process"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/"]
version = "1.0.39"

query = '''
process where event.action == "start" and
  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") and
  (
		(process.pe.original_file_name : (
		    "rundll32.exe", 
		    "regsvr32.exe", 
		    "bitsadmin.exe",
		    "certutil.exe", 
		    "installutil.exe", 
		    "schtasks.exe", 
		    "wmic.exe", 
		    "cscript.exe",
		    "cmstp.exe", 
		    "Microsoft.Workflow.Compiler.exe", 
		    "regasm.exe", 
		    "regsvcs.exe", 
		    "mshta.exe", 
		    "msxsl.exe", 
		    "ieexec.exe", 
		    "sc.exe",
		    "javaw.exe",
		    "pcalua.exe",
		    "curl.exe",
		    "ScriptRunner.exe",
		    "CertOC.exe",
		    "Workfolders.exe",
		    "odbcconf.exe",
		    "extrac32.exe",
		    "expand"
		   ) and
		not process.args : ("-Embedding", "-hashfile")
		) or
		
		(process.pe.original_file_name : "wscript.exe" and
		 process.command_line : ("*:\\ProgramData\\*",
		                         "*:\\Users\\Public\\*",
		                         "*\\AppData\\*",
		                         "*\\Windows\\Temp\\*",
		                         /* CVE-2021-40444 */
		                         "*../../..*", "*..\\..\\*", "*js:..*", "*vbs:..*", "*wsf:..*", "*jse:..*", "*vbe:..*")) or
		
		(process.pe.original_file_name : "msiexec.exe" and process.args : "http*") or
		/* Issue #439 */
		(process.name : "explorer.exe" and
		 process.args : ("*.hta*", "*.vb*", "*.wsh*", "*.js*", "*.ps*", "*.scr*", "*.pif*", "*bat*", "*.cmd*") and
		 /* FPs related to execution from file share */
		 not process.working_directory : "\\\\*"
		 ) or

		/* Masquerading as WerFault or Splwow64 both of which are common MS Office Child Processes */
		(process.name : ("WerFault.exe", "splwow64.exe") and process.args_count == 1) or

        /* in the wild 0 day - 52945af1def85b171870b31fa4782e52 */
		(process.pe.original_file_name == "msdt.exe" and process.command_line : "*IT_BrowseForFile*")

  ) and

	/* FP related to printing */
	not (process.name : "rundll32.exe" and process.command_line : "*\\system32\\spool\\*") and

	/* Issue #458 */
	not (process.name : "rundll32.exe" and
	     process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile", "shwebsvc.dll,AddNetPlaceRunDll")) and

    /* Issue #568 */
	not (process.name : "schtasks.exe" and process.args : "/change" and process.args : "Microsoft\\Office\\Office Serviceability Manager") and

	/* Issue #568 */
	not (process.name : "regsvr32.exe" and
	     process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\system32\\*.dll", "?:\\Windows\\system32\\*.ocx")) and

	not (process.executable : "?:\\Windows\\hh.exe" and process.args : "-mapid") and
	not (process.executable : "?:\\Windows\\System32\\sc.exe" and process.args : "queryex") and
	not (process.name : "rundll32.exe" and process.command_line : ("?:\\Windows\\SysWOW64\\rundll32.exe --eoim", "*--enable-speech-input --auto-scan-plugin --lang=*")) and
	not (process.name : "RegAsm.exe" and process.args :  "?:\\Program Files (x86)\\Thomson Reuters\\WSF\\*.dll") and
	not (process.name : "rundll32.exe" and
	     process.args : ("?:\\WINDOWS\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification",
	                     "printui.dll,PrintUIEntry",
	                     "InetCpl.cpl,ClearMyTracksByProcess",
	                     "url.dll,FileProtocolHandler")) and
	not (process.name : "hh.exe" and process.args : ("?:\\Program Files (x86)\\*", "?:\\Program Files (x86)\\*")) and
	not (process.name : "rundll32.exe" and process.command_line : "\"C:\\WINDOWS\\SysWOW64\\rundll32.exe\" --eoim") and
	not (process.name : "rundll32.exe" and process.args : "?:\\PROGRA~2\\MICROS~*\\Office*\\GrooveUtil.DLL,GetResourceModulePath") and
	not (process.name : "hh.exe" and process.args : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*")) and
	not (process.name : "javaw.exe" and process.args : "?:\\PROGRA~2\\Andar\\ANDARP~1\\bin\\andar.jar") and
	not (process.name : "rundll32.exe" and
	     process.args : ("?:\\Windows\\System32\\LogiLDA.dll,LogiFetch", "?:\\Windows\\System32\\dfshim.dll,ShOpenVerbShortcut")) and
	not (process.name : "rundll32.exe" and process.args : "-localserver" and process.args : "22d8c27b-47a1-48d1-ad08-7da7abd79617") and
	not process.executable : "?:\\Program Files (x86)\\Andar\\Jre*\\bin\\javaw.exe" and
	not (process.name : "mshta.exe" and process.args : "vbscript:close(CreateObject(WScript.Shell).Popup(Works only at day level,1,Warning))") and
	not (process.name : "rundll32.exe" and process.command_line : "\"C:\\Windows\\system32\\rundll32.exe\" --eoim")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "7.15.0"