Office Macro File Download

Status: test
Severity: low
Log source: category file_event, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.

Known false positives

Legitimate macro files downloaded from the internet
Legitimate macro files sent as attachments via emails

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.001` Phishing: Spearphishing Attachment

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Office Macro File Download
id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66
related:
    - id: 91174a41-dc8f-401b-be89-7bfc140612a0
      type: similar
status: test
description: |
    Detects the creation of a new office macro files on the system via an application (browser, mail client).
    This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
    - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-23
modified: 2025-10-29
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection_processes:
        Image|endswith:
            # Email clients
            - '\RuntimeBroker.exe' # Windows Email clients uses RuntimeBroker to create the files
            - '\outlook.exe'
            - '\thunderbird.exe'
            # Browsers
            - '\brave.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\maxthon.exe'
            - '\MicrosoftEdge.exe'
            - '\msedge.exe'
            - '\msedgewebview2.exe'
            - '\opera.exe'
            - '\safari.exe'
            - '\seamonkey.exe'
            - '\vivaldi.exe'
            - '\whale.exe'
    selection_ext:
        - TargetFilename|endswith:
              - '.docm'
              - '.dotm'
              - '.xlsm'
              - '.xltm'
              - '.potm'
              - '.pptm'
        - TargetFilename|contains:
              - '.docm:Zone'
              - '.dotm:Zone'
              - '.xlsm:Zone'
              - '.xltm:Zone'
              - '.potm:Zone'
              - '.pptm:Zone'
    condition: all of selection_*
falsepositives:
    - Legitimate macro files downloaded from the internet
    - Legitimate macro files sent as attachments via emails
level: low

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_processes`

selection_processes:
    Image|endswith:
        - '\RuntimeBroker.exe'
        - '\outlook.exe'
        - '\thunderbird.exe'
        - '\brave.exe'
        - '\chrome.exe'
        - '\firefox.exe'
        - '\iexplore.exe'
        - '\maxthon.exe'
        - '\MicrosoftEdge.exe'
        - '\msedge.exe'
        - '\msedgewebview2.exe'
        - '\opera.exe'
        - '\safari.exe'
        - '\seamonkey.exe'
        - '\vivaldi.exe'
        - '\whale.exe'

Stage 2: `selection_ext`

selection_ext:
    - TargetFilename|endswith:
          - '.docm'
          - '.dotm'
          - '.xlsm'
          - '.xltm'
          - '.potm'
          - '.pptm'
    - TargetFilename|contains:
          - '.docm:Zone'
          - '.dotm:Zone'
          - '.xlsm:Zone'
          - '.xltm:Zone'
          - '.potm:Zone'
          - '.pptm:Zone'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\MicrosoftEdge.exe` corpus 3 (sigma 3) `\RuntimeBroker.exe` corpus 4 (sigma 4) `\brave.exe` corpus 11 (sigma 11) `\chrome.exe` corpus 13 (sigma 13) `\firefox.exe` corpus 6 (sigma 6) `\iexplore.exe` corpus 4 (sigma 4) `\maxthon.exe` corpus 3 (sigma 3) `\msedge.exe` corpus 14 (sigma 14) `\msedgewebview2.exe` corpus 3 (sigma 3) `\opera.exe` corpus 11 (sigma 11) `\outlook.exe` corpus 13 (sigma 13) `\safari.exe` corpus 2 (sigma 2) `\seamonkey.exe` corpus 3 (sigma 3) `\thunderbird.exe` corpus 2 (sigma 2) `\vivaldi.exe` corpus 11 (sigma 11) `\whale.exe` corpus 3 (sigma 3)	`field:"Image" kind:ends_with`
`TargetFilename`	ends_with	`.docm` corpus 4 (sigma 4) `.dotm` corpus 4 (sigma 4) `.potm` corpus 3 (sigma 3) `.pptm` corpus 3 (sigma 3) `.xlsm` corpus 4 (sigma 4) `.xltm` corpus 4 (sigma 4)	`field:"TargetFilename" kind:ends_with`
`TargetFilename`	match	`.docm:Zone` corpus 2 (sigma 2) `.dotm:Zone` `.potm:Zone` `.pptm:Zone` corpus 2 (sigma 2) `.xlsm:Zone` corpus 2 (sigma 2) `.xltm:Zone`	`field:"TargetFilename" kind:match`