Sigma medium test sigma

OneNote Attachment File Dropped In Suspicious Location

Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments

View Source

Detection Logic

{
  "selection": {
    "TargetFilename
| contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\",
      ":\\Temp\\"
    ],
    "TargetFilename
| endswith": [
      ".one",
      ".onepkg"
    ]
  },
  "filter_main_onenote": {
    "Image
| contains": ":\\Program Files\\Microsoft Office\\",
    "Image
| endswith": "\\ONENOTE.EXE"
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

⚠ Legitimate usage of ".one" or ".onepkg" files from those locations

Field Validations

Loading…

Comments (0)

Loading comments...