detection.wiki

Detection rules › Sigma

Renamed Office Binary Execution

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the execution of a renamed office binary

MITRE ATT&CK coverage

TacticTechniques
StealthT1036.003 Masquerading: Rename Legitimate Utilities

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Renamed Office Binary Execution
id: 0b0cd537-fc77-4e6e-a973-e53495c1083d
status: test
description: Detects the execution of a renamed office binary
references:
    - https://infosec.exchange/@sbousseaden/109542254124022664
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-20
modified: 2025-12-09
tags:
    - attack.stealth
    - attack.t1036.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName:
              - 'Excel.exe'
              - 'MSACCESS.EXE'
              - 'MSPUB.EXE'
              - 'OneNote.exe'
              - 'OneNoteM.exe'
              - 'OUTLOOK.EXE'
              - 'POWERPNT.EXE'
              - 'WinWord.exe'
              - 'Olk.exe'
        - Description:
              - 'Microsoft Access'
              - 'Microsoft Excel'
              - 'Microsoft OneNote'
              - 'Microsoft Outlook'
              - 'Microsoft PowerPoint'
              - 'Microsoft Publisher'
              - 'Microsoft Word'
              - 'Sent to OneNote Tool'
    filter_main_legit_names:
        Image|endswith:
            - '\EXCEL.exe'
            - '\excelcnv.exe'
            - '\MSACCESS.exe'
            - '\MSPUB.EXE'
            - '\ONENOTE.EXE'
            - '\ONENOTEM.EXE'
            - '\OUTLOOK.EXE'
            - '\POWERPNT.EXE'
            - '\WINWORD.exe'
            - '\OLK.EXE'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    - OriginalFileName:
          - 'Excel.exe'
          - 'MSACCESS.EXE'
          - 'MSPUB.EXE'
          - 'OneNote.exe'
          - 'OneNoteM.exe'
          - 'OUTLOOK.EXE'
          - 'POWERPNT.EXE'
          - 'WinWord.exe'
          - 'Olk.exe'
    - Description:
          - 'Microsoft Access'
          - 'Microsoft Excel'
          - 'Microsoft OneNote'
          - 'Microsoft Outlook'
          - 'Microsoft PowerPoint'
          - 'Microsoft Publisher'
          - 'Microsoft Word'
          - 'Sent to OneNote Tool'

Stage 2: not filter_main_legit_names

filter_main_legit_names:
    Image|endswith:
        - '\EXCEL.exe'
        - '\excelcnv.exe'
        - '\MSACCESS.exe'
        - '\MSPUB.EXE'
        - '\ONENOTE.EXE'
        - '\ONENOTEM.EXE'
        - '\OUTLOOK.EXE'
        - '\POWERPNT.EXE'
        - '\WINWORD.exe'
        - '\OLK.EXE'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with\EXCEL.exe
Imageends_with\MSACCESS.exe
Imageends_with\MSPUB.EXE
Imageends_with\OLK.EXE
Imageends_with\ONENOTE.EXE
Imageends_with\ONENOTEM.EXE
Imageends_with\OUTLOOK.EXE
Imageends_with\POWERPNT.EXE
Imageends_with\WINWORD.exe
Imageends_with\excelcnv.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Descriptioneq
  • Microsoft Access
  • Microsoft Excel
  • Microsoft OneNote
  • Microsoft Outlook
  • Microsoft PowerPoint
  • Microsoft Publisher
  • Microsoft Word
  • Sent to OneNote Tool
OriginalFileNameeq
  • Excel.exe corpus 4 (sigma 3, elastic 1)
  • MSACCESS.EXE corpus 2 (sigma 1, elastic 1)
  • MSPUB.EXE corpus 3 (sigma 2, elastic 1)
  • OUTLOOK.EXE corpus 2 (sigma 1, elastic 1)
  • Olk.exe
  • OneNote.exe
  • OneNoteM.exe
  • POWERPNT.EXE corpus 4 (sigma 3, elastic 1)
  • WinWord.exe corpus 6 (sigma 4, elastic 2)