Detectionlowtest
Office Macro File Creation
Detects the creation of a new office macro files on the systems
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Sun Jan 23Updated Fri Jan 0991174a41-dc8f-401b-be89-7bfc140612a0windows
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic2 selectors
detection:
selection:
TargetFilename|endswith:
- '.docm'
- '.dotm'
- '.xlsm'
- '.xltm'
- '.potm'
- '.pptm'
filter_main_office:
Image|startswith:
- 'C:\Program Files\Microsoft Office\'
- 'C:\Program Files (x86)\Microsoft Office\'
Image|endswith:
- '\WINWORD.EXE'
- '\EXCEL.EXE'
- '\POWERPNT.EXE'
TargetFilename|contains: '\~$' # Temporary files created by Office applications
condition: selection and not 1 of filter_main_*False Positives
Very common in environments that rely heavily on macro documents
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
91174a41-dc8f-401b-be89-7bfc140612a0
Status
test
Level
low
Type
Detection
Created
Sun Jan 23
Modified
Fri Jan 09
Path
rules/windows/file/file_event/file_event_win_office_macro_files_created.yml
Raw Tags
attack.initial-accessattack.t1566.001