Hayabusa high test sigma

Suspicious Download from Office Domain

Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_download": [
    {
      "NewProcessName
| endswith": [
        "\\curl.exe",
        "\\wget.exe"
      ]
    },
    {
      "CommandLine
| contains": [
        "Invoke-WebRequest",
        "iwr ",
        "curl ",
        "wget ",
        "Start-BitsTransfer",
        ".DownloadFile(",
        ".DownloadString("
      ]
    }
  ],
  "selection_domains": {
    "CommandLine
| contains": [
      "https://attachment.outlook.live.net/owa/",
      "https://onenoteonlinesync.onenote.com/onenoteonlinesync/"
    ]
  },
  "condition": "process_creation and (all of selection_*)"
}

False Positives

  • ⚠ Scripts or tools that download attachments from these domains (OneNote, Outlook 365)

Field Validations

Loading…

Comments (0)

Loading comments...