Detectionhightest

Potential Persistence Via Microsoft Office Startup Folder

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)Created Thu Jun 02Updated Thu Jun 220e20c89d-2264-44ae-8238-aeeaba609ecewindows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection_word_paths:
        - TargetFilename|contains: '\Microsoft\Word\STARTUP'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\STARTUP'
    selection_word_extension:
        TargetFilename|endswith:
            - '.doc'
            - '.docm'
            - '.docx'
            - '.dot'
            - '.dotm'
            - '.rtf'
    selection_excel_paths:
        - TargetFilename|contains: '\Microsoft\Excel\XLSTART'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\XLSTART'
    selection_excel_extension:
        TargetFilename|endswith:
            - '.xls'
            - '.xlsm'
            - '.xlsx'
            - '.xlt'
            - '.xltm'
    filter_main_office:
        Image|endswith:
            - '\WINWORD.exe'
            - '\EXCEL.exe'
    condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office