Elastic Defend high stable eql

Suspicious File Dropped by a Macro Enabled Document

Identifies when a Microsoft Office process writes an executable file type and from a call stack pointing to Microsoft Office Visual Basic for Applications modules. This may indicate an attempt to get initial access using malicious macro enabled documents.

View Source

Detection Logic

file where event.action != "deletion" and event.action != "open" and
   process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "mspub.exe", "fltldr.exe", "visio.exe") and
   process.thread.Ext.call_stack_summary : "*
| vbe?.dll*" and
   (file.extension : ("exe", "pif", "scr", "iso", "rar", "7z", "img", "vhd", "js", "vbs", "wsh", "hta", "cpl", "jse", "vbe", "bat", "cmd", "dll") or
    file.Ext.header_bytes : ("4d5a*", "TVqQ*", "406563686F*", "3c736372697074206c616e6775616765", "76617220*")) and
   not (file.extension == "zip" and file.Ext.header_bytes == "504b0506000000000000000000000000")

Field Validations

Loading…

Comments (0)

Loading comments...