Detecting Macro Invoking ShellBrowserWindow COM Objects

Status: available
Severity: medium
Time window: 1h
Group by: CommandLine, Computer, Description, EventID, Image, ParentCommandLine, ParentImage, ParentProcessGuid, ParentUser, ProcessGuid, User
Source: github.com/Azure/Azure-Sentinel

This query detects a macro invoking ShellBrowserWindow COM Objects evade naive parent/child Office detection rules.

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.003` Remote Services: Distributed Component Object Model

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: e7470b35-0128-4508-bfc9-e01cfb3c2eb7
name: Detecting Macro Invoking ShellBrowserWindow COM Objects
description: |
  'This query detects a macro invoking ShellBrowserWindow COM Objects evade naive parent/child Office detection rules.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
relevantTechniques:
  - T1021.003
query: |
 Event
  | where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID==1
  | parse EventData with * 'Image">' Image "<" * 'CommandLine">' CommandLine "<" * 'ParentImage">' ParentImage "<" *
  | where ParentImage has "svchost.exe" and Image has "rundll32.exe" and CommandLine has "{c08afd90-f2a1-11d1-8455-00a0c91f3880}"
  | parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Description">' Description "<" * 'CurrentDirectory">' CurrentDirectory "<" * 'User">' User "<" * 'LogonGuid">' LogonGuid "<" * 'ParentProcessGuid">' ParentProcessGuid "<" * 'ParentImage">' ParentImage "<" * 'ParentCommandLine">' ParentCommandLine "<" * 'ParentUser">' ParentUser "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ParentImage, ParentProcessGuid, ParentCommandLine, ParentUser, Image, ProcessGuid, CommandLine, Description
  | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')
entityMappings:
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: CommandLine
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: User
version: 1.0.4
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Event

Stage 2: `where`

| where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID==1

Stage 3: `parse`

| parse EventData with * 'Image">' Image "<" * 'CommandLine">' CommandLine "<" * 'ParentImage">' ParentImage "<" *

Stage 4: `where`

| where ParentImage has "svchost.exe" and Image has "rundll32.exe" and CommandLine has "{c08afd90-f2a1-11d1-8455-00a0c91f3880}"

Stage 5: `parse`

| parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Description">' Description "<" * 'CurrentDirectory">' CurrentDirectory "<" * 'User">' User "<" * 'LogonGuid">' LogonGuid "<" * 'ParentProcessGuid">' ParentProcessGuid "<" * 'ParentImage">' ParentImage "<" * 'ParentCommandLine">' ParentCommandLine "<" * 'ParentUser">' ParentUser "<" *

Stage 6: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ParentImage, ParentProcessGuid, ParentCommandLine, ParentUser, Image, ProcessGuid, CommandLine, Description

Stage 7: `extend`

| extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`{c08afd90-f2a1-11d1-8455-00a0c91f3880}` transforms: `term`	`field:"CommandLine" kind:match value:"{c08afd90-f2a1-11d1-8455-00a0c91f3880}"`
`EventID`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`EventLog`	eq	`Microsoft-Windows-Sysmon/Operational` corpus 7 (kusto 7)	`field:"EventLog" kind:eq value:"Microsoft-Windows-Sysmon/Operational"`
`Image`	match	`rundll32.exe` transforms: `term`	`field:"Image" kind:match value:"rundll32.exe"`
`ParentImage`	match	`svchost.exe` transforms: `term`	`field:"ParentImage" kind:match value:"svchost.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CommandLine`	`summarize`
`Computer`	`summarize`
`Description`	`summarize`
`EndTime`	`summarize`
`EventID`	`summarize`
`Image`	`summarize`
`ParentCommandLine`	`summarize`
`ParentImage`	`summarize`
`ParentProcessGuid`	`summarize`
`ParentUser`	`summarize`
`ProcessGuid`	`summarize`
`StartTime`	`summarize`
`User`	`summarize`
`DnsDomain`	`extend`
`HostName`	`extend`

Detecting Macro Invoking ShellBrowserWindow COM Objects

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: parse

Stage 4: where

Stage 5: parse

Stage 6: summarize

Stage 7: extend