Suspicious Download from Office Domain

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Known false positives

Scripts or tools that download attachments from these domains (OneNote, Outlook 365)

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1608` Stage Capabilities
Command & Control	`T1105` Ingress Tool Transfer

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Suspicious Download from Office Domain
id: 00d49ed5-4491-4271-a8db-650a4ef6f8c1
status: test
description: Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
references:
    - https://twitter.com/an0n_r0/status/1474698356635193346?s=12
    - https://twitter.com/mrd0x/status/1475085452784844803?s=12
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-12-27
modified: 2022-08-02
tags:
    - attack.command-and-control
    - attack.resource-development
    - attack.t1105
    - attack.t1608
logsource:
    product: windows
    category: process_creation
detection:
    selection_download:
        - Image|endswith:
              - '\curl.exe'
              - '\wget.exe'
        - CommandLine|contains:
              - 'Invoke-WebRequest'
              - 'iwr '
              - 'curl '
              - 'wget '
              - 'Start-BitsTransfer'
              - '.DownloadFile('
              - '.DownloadString('
    selection_domains:
        CommandLine|contains:
            - 'https://attachment.outlook.live.net/owa/'
            - 'https://onenoteonlinesync.onenote.com/onenoteonlinesync/'
    condition: all of selection_*
falsepositives:
    - Scripts or tools that download attachments from these domains (OneNote, Outlook 365)
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_download`

selection_download:
    - Image|endswith:
          - '\curl.exe'
          - '\wget.exe'
    - CommandLine|contains:
          - 'Invoke-WebRequest'
          - 'iwr '
          - 'curl '
          - 'wget '
          - 'Start-BitsTransfer'
          - '.DownloadFile('
          - '.DownloadString('

Stage 2: `selection_domains`

selection_domains:
    CommandLine|contains:
        - 'https://attachment.outlook.live.net/owa/'
        - 'https://onenoteonlinesync.onenote.com/onenoteonlinesync/'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`.DownloadFile(` corpus 8 (sigma 7, chronicle 1) `.DownloadString(` corpus 8 (sigma 7, chronicle 1) `Invoke-WebRequest` corpus 15 (sigma 10, elastic 3, chronicle 1, kusto 1) `Start-BitsTransfer` corpus 5 (sigma 3, elastic 1, splunk 1) `curl` corpus 17 (sigma 11, elastic 5, chronicle 1) `https://attachment.outlook.live.net/owa/` `https://onenoteonlinesync.onenote.com/onenoteonlinesync/` `iwr` corpus 13 (sigma 11, chronicle 2) `wget` corpus 13 (sigma 7, elastic 5, chronicle 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\curl.exe` corpus 31 (sigma 31) `\wget.exe` corpus 9 (sigma 9)	`field:"Image" kind:ends_with`

Suspicious Download from Office Domain

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_download

Stage 2: selection_domains

Indicators

Stage 0: `condition`

Stage 1: `selection_download`

Stage 2: `selection_domains`