Techniques
Sample rules
Office Macro File Creation
- source: sigma
- technicques:
- t1566
- t1566.001
Description
Detects the creation of a new office macro files on the systems
Detection logic
condition: selection and not 1 of filter_main_*
filter_main_office:
Image|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|startswith:
- C:\Program Files\Microsoft Office\
- C:\Program Files (x86)\Microsoft Office\
TargetFilename|contains: \~$
selection:
TargetFilename|endswith:
- .docm
- .dotm
- .xlsm
- .xltm
- .potm
- .pptm