Office Application Startup via Template File Modification

[rule]
description = """
Adversaries can modify default Microsoft Office templates in order to establish persistence using malicious Macro
templates.
"""
id = "608eae71-6797-4ded-bfaa-41bcb17a8498"
license = "Elastic License v2"
name = "Office Application Startup via Template File Modification"
os_list = ["windows"]
reference = ["https://attack.mitre.org/techniques/T1137/001/"]
version = "1.0.30"

query = '''
file where event.action in ("creation", "overwrite") and process.pid != 4 and
  process.name != null and user.name != null and
  file.path :
    ("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
     "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB") and file.size > 0 and
  not process.thread.Ext.call_stack_summary in
                        ("sysfer.dll|apphelp.dll|kernelbase.dll|migcore.dll|loadstate.exe|kernel32.dll|ntdll.dll",
                         "ntdll.dll|apphelp.dll|kernelbase.dll|migcore.dll|loadstate.exe|kernel32.dll|ntdll.dll") and
  not process.executable : ("?:\\Windows\\System32\\svchost.exe",
                            "?:\\Windows\\explorer.exe",
                            "?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe",
                            "?:\\Program Files (x86)\\Citrix\\User Profile Manager\\UserProfileManager.exe",
                            "?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe",
                            "?:\\ProgramData\\ForensiT\\Transwiz\\Deployment Files\\Transwiz.exe",
                            "C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\User State Migration Tool\\amd64\\loadstate.exe",
                            "?:\\Windows\\Sys*\\xcopy.exe",
                            "?:\\Windows\\Sys*\\Robocopy.exe",
                            "?:\\Program Files\\Veeam\\Endpoint Backup\\*.exe",
                            "?:\\Program Files (x86)\\Laplink PCmover\\PCmoverHost.exe",
                            "?:\\Windows\\System32\\dllhost.exe",
                            "C:\\Windows\\System32\\cmd.exe",
                            "D:\\SuperGrate*.exe",
                            "\\Device\\Mup\\*.exe") and
  not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1137"
name = "Office Application Startup"
reference = "https://attack.mitre.org/techniques/T1137/"
[[threat.technique.subtechnique]]
id = "T1137.001"
name = "Office Template Macros"
reference = "https://attack.mitre.org/techniques/T1137/001/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"

[internal]
min_endpoint_version = "8.10.0"