Sigma low test sigma

Office Macro File Creation

Detects the creation of a new office macro files on the systems

View Source

Detection Logic

{
  "selection": {
    "TargetFilename
| endswith": [
      ".docm",
      ".dotm",
      ".xlsm",
      ".xltm",
      ".potm",
      ".pptm"
    ]
  },
  "filter_main_office": {
    "Image
| startswith": [
      "C:\\Program Files\\Microsoft Office\\",
      "C:\\Program Files (x86)\\Microsoft Office\\"
    ],
    "Image
| endswith": [
      "\\WINWORD.EXE",
      "\\EXCEL.EXE",
      "\\POWERPNT.EXE"
    ],
    "TargetFilename
| contains": "\\~$"
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

  • ⚠ Very common in environments that rely heavily on macro documents

Field Validations

Loading…

Comments (0)

Loading comments...