Sigma rule: OneNote Attachment File Dropped In Suspicious Location

Rule

Title

OneNote Attachment File Dropped In Suspicious Location

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-01-22

Modified

2023-09-19

File

rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|contains:
        # Note: add more common locations for drops such as download folders and the like. Or baseline legitimate locations and alert on everything else
        - '\AppData\Local\Temp\'
        - '\Users\Public\'
        - '\Windows\Temp\'
        - ':\Temp\'
    TargetFilename|endswith:
        - '.one'
        - '.onepkg'
filter_main_onenote:
    Image|contains: ':\Program Files\Microsoft Office\'
    Image|endswith: '\ONENOTE.EXE'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate usage of ".one" or ".onepkg" files from those locations

Tags

• attack.stealth

References

• https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
• https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml