Sigma rule: File Creation by Office Applications

Rule

Title

File Creation by Office Applications

Status

experimental

Level

high

Author

Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)

Date

2021/08/23

Modified

2022/06/02

File

unsupported/windows/file_event_executable_and_script_creation_by_office_using_file_ext.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.

Log source

product

windows

category

file_event

Detection

#useful_information: Please add more file extensions and magic bytes to the logic of your choice.
selection1:
    Image|endswith:
        - '\winword.exe'
        - '\excel.exe'
        - '\powerpnt.exe'
        - '\outlook.exe'
selection2:
    FileName|endswith:
        - ".exe"
        - ".dll"
        - ".ocx"
        - ".com"
        - ".ps1"
        - ".vbs"
        - ".sys"
        - ".bat"
        - ".scr"
        - ".proj"
selection3:
    FileMagicBytes|startswith:
        - "4D5A"
condition: selection1 and (selection2 or selection3)

False positives (as the rule lists them)

• Unknown

Tags

• attack.t1204.002
• attack.t1047
• attack.t1218.010
• attack.execution
• attack.defense_evasion

MITRE ATT&CK ids this rule names

• T1047
• T1204.002
• T1218.010

References

• https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
• https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/file_event_executable_and_script_creation_by_office_using_file_ext.yml