detection.wiki

Detection rules › Sigma

Suspicious New Instance Of An Office COM Object

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc. This can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique
StealthNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Suspicious New Instance Of An Office COM Object
id: 9bdaf1e9-fdef-443b-8081-4341b74a7e28
status: test
description: |
    Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.
    This can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)
references:
    - https://learn.microsoft.com/en-us/previous-versions/office/troubleshoot/office-developer/automate-word-create-file-using-visual-basic
    - https://github.com/med0x2e/vba2clr
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-13
modified: 2023-12-19
tags:
    - attack.execution
    - detection.threat-hunting
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\svchost.exe'
        Image|endswith:
            - '\eqnedt32.exe'
            - '\excel.exe'
            - '\msaccess.exe'
            - '\mspub.exe'
            - '\powerpnt.exe'
            - '\visio.exe'
            - '\winword.exe'
    condition: selection
falsepositives:
    - Legitimate usage of office automation via scripting
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    ParentImage|endswith: '\svchost.exe'
    Image|endswith:
        - '\eqnedt32.exe'
        - '\excel.exe'
        - '\msaccess.exe'
        - '\mspub.exe'
        - '\powerpnt.exe'
        - '\visio.exe'
        - '\winword.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \eqnedt32.exe corpus 6 (sigma 6)
  • \excel.exe corpus 18 (sigma 18)
  • \msaccess.exe corpus 4 (sigma 4)
  • \mspub.exe corpus 10 (sigma 10)
  • \powerpnt.exe corpus 15 (sigma 15)
  • \visio.exe corpus 3 (sigma 3)
  • \winword.exe corpus 20 (sigma 20)
ParentImageends_with
  • \svchost.exe corpus 14 (sigma 14)