Aegis
Rule library
// Detection

Office application spawning a script interpreter

A document application starting a shell or scripting host. Word does not legitimately need to launch PowerShell, so this is near-always macro execution.

HighInvestigating1alerts raisedSignature
Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

Any event where parentProcess is one of winword.exe, excel.exe, outlook.exe, powerpnt.exe

{
  "kind": "match",
  "where": [
    {
      "op": "in",
      "field": "parentProcess",
      "value": [
        "winword.exe",
        "excel.exe",
        "outlook.exe",
        "powerpnt.exe"
      ]
    }
  ]
}

Revise

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

Alerts raised (1)

What this rule has actually caught.

AlertFindingStatusRiskRaised
ALT-D6DD3Dwinword.exe created cmd.exe on WS-FIN-004, which used certutil to retrieve u.dat from 45.61.136.14 and registered it as a recurring scheduled task.New78

Rule

Category
Execution
ATT&CK tactic
Execution
Technique
T1204.002
Kind
Signature
State
Armed
Created
7d ago
Last changed
7d ago

Firing history

Total alerts
1
First fired
7d ago
Last fired
7d ago
Escalated to cases
0
Dismissed benign
0

Related