Windows Command Shell Spawned via Microsoft Office

[rule]
description = """
Identifies a Microsoft Office application starting a Windows command prompt with suspicious command line arguments. This
behavior is consistent with a victim opening a malicious document and executing an attacker's malicious code.
"""
id = "2a396a3c-b343-42a9-b74b-c5b9925b6ee2"
license = "Elastic License v2"
name = "Windows Command Shell Spawned via Microsoft Office"
os_list = ["windows"]
reference = ["https://github.com/danielbohannon/Invoke-DOSfuscation"]
version = "1.0.33"

query = '''
process where event.action == "start" and
  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") and
  (process.pe.original_file_name == "Cmd.Exe" or process.name : "cmd.exe") and
  process.command_line :
              ("*^*^*^*^*^*",
              "*set *set *set *",
              "*set *for *call *",
              "*set *for *cmd *",
              "*$*$*$*$*",
              "*comspec*",
              "*powershell*",
              "*wscript*",
              "*cscript*",
              "*mshta*", 
              "*certutil*", 
              "*bitsadmin*", 
              "*/transfer*",
              "*-transfer*",
              "*urlcache*", 
              "*-decode*", 
              "*addfile*",
              "*msbuild*",
              "*msiexec*",
              "*rundll32*",
              "*regsvr32*", 
              "*ping * -n *&*",
              "*http://*",
              "*%%*%%*%%*", 
              "*copy*.exe*") and
  not process.command_line : 
             ("*:\\Program Files\\Tableau\\*--server*http://tableau*", 
              "*:\\Program Files (x86)\\Tableau\\*--server*http://tableau*", 
              "\"C:\\Windows\\System32\\cmd.exe\" /c C:\\windows\\System32\\rundll32 advpack.dll,LaunchINFSection \"C:\\Users\\*\\AppData\\Roaming\\McGowan Partners LLC UAT\\setup.inf\", DefaultInstall*") and 
  not process.args : "$bytes=[System.Text.Encoding]::UTF8.GetBytes('*');$hash=[System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes);[BitConverter]::ToString($hash).Replace('-','').ToLower()"
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"