Hayabusa high test sigma

Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp

Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_parent": {
    "ParentImage
| endswith": "\\excel.exe"
  },
  "selection_child": [
    {
      "OriginalFileName": [
        "foxprow.exe",
        "schdplus.exe",
        "winproj.exe"
      ]
    },
    {
      "Image
| endswith": [
        "\\foxprow.exe",
        "\\schdplus.exe",
        "\\winproj.exe"
      ]
    }
  ],
  "condition": "process_creation and (all of selection_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...