name: Suspicious Microsoft Office embedded object
id: 47368d49-1192-4059-9c55-6bbc4fd1a73a
version: 1.0.0
description: |
  Identifies Microsoft Office processes dropping a file with suspicious
  extension and with the call stack indicating operations to save or load
  the file from an embedded OLE object.
labels:
  tactic.id: TA0001
  tactic.name: Initial Access
  tactic.ref: https://attack.mitre.org/tactics/TA0001/
  technique.id: T1566
  technique.name: Phishing
  technique.ref: https://attack.mitre.org/techniques/T1566/
  subtechnique.id: T1566.001
  subtechnique.name: Spearphishing Attachment
  subtechnique.ref: https://attack.mitre.org/techniques/T1566/001/

condition: >
  create_file
    and
  ps.name iin msoffice_binaries
    and
  thread.callstack.symbols imatches ('*!OleSaveStream*', '*!OleLoad*', '*!OleCreate*')
    and
  (
    file.extension iin ('.exe', '.dll', '.js', '.vbs', '.vbe', '.jse', '.url', '.chm', '.bat', '.mht', '.hta', '.search-ms')
      or
    (file.is_exec or file.is_dll)
  )

min-engine-version: 2.2.0
