name: Executable file creation from a macro-enabled Microsoft Office document
id: fffcce75-2427-406e-9597-1f49b0c9ad5b
version: 1.0.0
description: |
  Identifies the Microsoft Office process writing an executable file type and
  the call stack reveals the file creation was originated from the Microsoft
  Visual Basic for Applications module. This may be an indicator of initial
  access using malicious macro-enabled documents.
labels:
  tactic.id: TA0001
  tactic.name: Initial Access
  tactic.ref: https://attack.mitre.org/tactics/TA0001/
  technique.id: T1566
  technique.name: Phishing
  technique.ref: https://attack.mitre.org/techniques/T1566/
  subtechnique.id: T1566.001
  subtechnique.name: Spearphishing Attachment
  subtechnique.ref: https://attack.mitre.org/techniques/T1566/001/

condition: >
  create_file
    and
  ps.name in msoffice_binaries
    and
  thread.callstack.modules imatches 'vbe?.dll'
    and
  (
    file.extension iin ('.vbs', '.js', '.jar', '.exe', '.dll', '.com',
                        '.ps1', '.hta', '.cmd', '.vbe', '.rar.', '.zip',
                        '.iso', '.img', '.wsh', '.bat', '.cpl', '.7z'
                        )
      or
    (file.is_exec or file.is_dll)
  )

min-engine-version: 2.2.0
