ProtocolHandler.exe File Download (PowerShell)

id: '21901.38725'
title: ProtocolHandler.exe File Download
description: ProtocolHandler.exe is a component of Microsoft Office and is typically
  used for accessing Microsoft Office documents from Outlook and Sharepoint. Adversaries
  can use ProtocolHandler.exe to download files. This use case detects executions
  of ProtocolHandler.exe followed by URLs in the command line. Allowlisting of expected
  Sharepoint domains is recommended to reduce false positives. LOLBINS/LOLBAS
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<" OR TERM(EventCode=4103) OR "<EventID>4103<") "ProtocolHandler.exe"
  | regex process="(?i)ProtocolHandler\.exe\"?\s+\"?[A-Za-z0-9]{2,6}:\/\/" | table
  _time, host, user, signature_id, process, process_*, parent_process_path, parent_process_name
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:ingress tool transfer
technique_id: 
- T1105
data_category:
- PowerShell logs
references:
- https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/ProtocolHandler/