Ms_office — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/ms_office/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 18:15:00 +0000Execution of File Written or Modified by Microsoft Officehttps://feed.craftedsignal.io/briefs/2024-01-office-written-executable/Wed, 03 Jan 2024 18:15:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-office-written-executable/This rule detects the creation and execution of executable files by Microsoft Office applications, which is often associated with malicious documents containing scripts or exploitation of Microsoft Office vulnerabilities, leading to the execution of arbitrary code.This detection identifies instances where Microsoft Office applications (WINWORD.EXE, EXCEL.EXE, OUTLOOK.EXE, POWERPNT.EXE, MSPUB.EXE, MSACCESS.EXE, eqnedt32.exe, and fltldr.exe) write or modify executable files (.exe) on a Windows system, followed by the execution of these files. This behavior is often indicative of malicious activity, such as exploitation of Office vulnerabilities or the execution of malicious scripts embedded within Office documents. The rule excludes signed Microsoft NewOutlookInstaller.exe and Citrix ShareFileForOutlook helpers to reduce false positives. This activity is important for defenders to monitor because it can lead to arbitrary code execution and compromise of the system.

Attack Chain

  1. A user opens a malicious Microsoft Office document (e.g., Word, Excel, PowerPoint).
  2. The document contains a malicious script or exploits a vulnerability in the Office application.
  3. The Office application (e.g., WINWORD.EXE) writes a new executable file (.exe) to disk, often in a temporary directory or user-writable location.
  4. The malicious script or exploit executes the newly created executable file.
  5. The executed file performs malicious actions, such as downloading additional malware, establishing persistence, or compromising sensitive data.
  6. The malware may attempt to escalate privileges to gain broader access to the system.
  7. The malware may attempt to move laterally to other systems on the network.
  8. The final objective could be data exfiltration, ransomware deployment, or other malicious activities.

Impact

Successful exploitation can lead to arbitrary code execution, allowing attackers to install malware, steal sensitive information, or take control of the compromised system. Depending on the privileges of the user and the nature of the malware, this can result in significant data loss, system disruption, and potential financial damage. If lateral movement is successful, the attacker may compromise multiple systems, increasing the scope of the attack.

Recommendation

  • Enable process creation logging in Windows and monitor for the execution of executable files written or modified by Microsoft Office applications to activate the rules below.
  • Deploy the Sigma rules provided in this brief to your SIEM and tune for your specific environment.
  • Investigate any alerts generated by the Sigma rules, focusing on the parent process, file path, and command-line arguments of the executed file.
  • Implement application control policies to restrict the execution of unauthorized executables in user-writable directories.
]]>highadvisoryexecutionms_officefile_creationmalware