Suspicious Microsoft Office Embedded Object

[rule]
description = """
Identifies suspicious file extensions written by a Microsoft Office process from an embedded OLE stream, this is
frequently used by malicious documents to drop malicious content for initial access.
"""
id = "a3afbd2f-e9e6-41d9-ad24-aecb6a4b6906"
license = "Elastic License v2"
name = "Suspicious Microsoft Office Embedded Object"
os_list = ["windows"]
version = "1.0.9"

query = '''
file where event.action != "deletion" and process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*!OleSaveToStream*", "*!OleLoad*")) and
 (
  file.extension : ("exe", "dll", "js", "vbs", "vbe", "jse", "url", "chm", "bat", "mht", "hta", "search-ms") or

  /* PE & HelpFile */
  file.Ext.header_bytes : ("4d5a*", "49545346*")
  )
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1203"
name = "Exploitation for Client Execution"
reference = "https://attack.mitre.org/techniques/T1203/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.7.0"