initial_access_microsoft_office_file_execution_via_script_interpreter.yml

name: Microsoft Office file execution via script interpreter
id: bf3ea547-1470-4bcc-9945-3b495d962c2c
version: 1.0.3
description: |
  Identifies the execution via Windows script interpreter of the executable file written 
  by the Microsoft Office process.
labels:
  tactic.id: TA0001
  tactic.name: Initial Access
  tactic.ref: https://attack.mitre.org/tactics/TA0001/
  technique.id: T1566
  technique.name: Phishing
  technique.ref: https://attack.mitre.org/techniques/T1566/
  subtechnique.id: T1566.001
  subtechnique.name: Spearphishing Attachment
  subtechnique.ref: https://attack.mitre.org/techniques/T1566/001/

condition: >
  sequence
  maxspan 2m
    |create_file and
     ps.name iin msoffice_binaries and (file.extension iin ('.exe', '.com', '.scr', '.pif', '.bat') or file.is_exec = true)
    | by file.path
    |spawn_process and
     ps.parent.name iin script_interpreters and
     ps.exe not imatches
                      (
                        '?:\\Program Files\\*.exe',
                        '?:\\Program Files (x86)\\*.exe'
                      )
    | by ps.exe
action:
  - name: kill

output: >
  Microsoft Office process %1.ps.exe wrote the file %1.file.path and subsequently executed it via script interpreter %2.ps.exe
severity: high

min-engine-version: 3.0.0