name: Process spawned from macro-enabled Microsoft Office document
id: 47521206-e19d-4608-9dbc-dc3a1df99db5
version: 1.0.0
description: |
  Identifies the execution of the child process spawned by Microsoft
  Office parent process where the call stack contains the Visual Basic
  for Applications modules or suspicious symbols. This is a strong
  indicative of the presence of a weaponized macro-enabled document.
labels:
  tactic.id: TA0001
  tactic.name: Initial Access
  tactic.ref: https://attack.mitre.org/tactics/TA0001/
  technique.id: T1566
  technique.name: Phishing
  technique.ref: https://attack.mitre.org/techniques/T1566/
  subtechnique.id: T1566.001
  subtechnique.name: Spearphishing Attachment
  subtechnique.ref: https://attack.mitre.org/techniques/T1566/001/

condition: >
  spawn_process
    and
  ps.parent.name iin msoffice_binaries
    and
  (
    thread.callstack.modules imatches '*vbe?.dll'
      or
    thread.callstack.symbols imatches
      (
        '*!xlAutoOpen*',
        '*!wlAutoOpen*',
        '*!wdAutoOpen*',
        'kernel32.dll!WinExec*',
        'shell32.dll!ShellExecute*'
      )
  )
    and
    not
  ps.child.exe imatches
    (
      '?:\\Windows\\explorer.exe',
      '?:\\Windows\\hh.exe',
      '?:\\Windows\\System32\\spool\\drivers\\*',
      '?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe'
    )

min-engine-version: 2.2.0
