Sigma rule: Suspicious Microsoft OneNote Child Process

Rule

Title

Suspicious Microsoft OneNote Child Process

Status

test

Level

high

Author

Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

Date

2022-10-21

Modified

2023-02-10

File

rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '\onenote.exe'
selection_opt_img:
    - OriginalFileName:
          - 'bitsadmin.exe'
          - 'CertOC.exe'
          - 'CertUtil.exe'
          - 'Cmd.Exe'
          - 'CMSTP.EXE'
          - 'cscript.exe'
          - 'curl.exe'
          - 'HH.exe'
          - 'IEExec.exe'
          - 'InstallUtil.exe'
          - 'javaw.exe'
          - 'Microsoft.Workflow.Compiler.exe'
          - 'msdt.exe'
          - 'MSHTA.EXE'
          - 'msiexec.exe'
          - 'Msxsl.exe'
          - 'odbcconf.exe'
          - 'pcalua.exe'
          - 'PowerShell.EXE'
          - 'RegAsm.exe'
          - 'RegSvcs.exe'
          - 'REGSVR32.exe'
          - 'RUNDLL32.exe'
          - 'schtasks.exe'
          - 'ScriptRunner.exe'
          - 'wmic.exe'
          - 'WorkFolders.exe'
          - 'wscript.exe'
    - Image|endswith:
          - '\AppVLP.exe'
          - '\bash.exe'
          - '\bitsadmin.exe'
          - '\certoc.exe'
          - '\certutil.exe'
          - '\cmd.exe'
          - '\cmstp.exe'
          - '\control.exe'
          - '\cscript.exe'
          - '\curl.exe'
          - '\forfiles.exe'
          - '\hh.exe'
          - '\ieexec.exe'
          - '\installutil.exe'
          - '\javaw.exe'
          - '\mftrace.exe'
          - '\Microsoft.Workflow.Compiler.exe'
          - '\msbuild.exe'
          - '\msdt.exe'
          - '\mshta.exe'
          - '\msidb.exe'
          - '\msiexec.exe'
          - '\msxsl.exe'
          - '\odbcconf.exe'
          - '\pcalua.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\regasm.exe'
          - '\regsvcs.exe'
          - '\regsvr32.exe'
          - '\rundll32.exe'
          - '\schtasks.exe'
          - '\scrcons.exe'
          - '\scriptrunner.exe'
          - '\sh.exe'
          - '\svchost.exe'
          - '\verclsid.exe'
          - '\wmic.exe'
          - '\workfolders.exe'
          - '\wscript.exe'
selection_opt_explorer:
    Image|endswith: '\explorer.exe'
    CommandLine|contains:
        - '.hta'
        - '.vb'
        - '.wsh'
        - '.js'
        - '.ps'
        - '.scr'
        - '.pif'
        - '.bat'
        - '.cmd'
selection_opt_paths:
    Image|contains:
        - '\AppData\'
        - '\Users\Public\'
        - '\ProgramData\'
        - '\Windows\Tasks\'
        - '\Windows\Temp\'
        - '\Windows\System32\Tasks\'
filter_teams:
    Image|endswith: '\AppData\Local\Microsoft\Teams\current\Teams.exe'
    CommandLine|endswith: '-Embedding'
filter_onedrive:
    Image|contains: '\AppData\Local\Microsoft\OneDrive\'
    Image|endswith: '\FileCoAuth.exe'
    CommandLine|endswith: '-Embedding'
condition: selection_parent and 1 of selection_opt_* and not 1 of filter_*

False positives (as the rule lists them)

• File located in the AppData folder with trusted signature

Tags

• attack.t1566
• attack.t1566.001
• attack.initial-access

MITRE ATT&CK ids this rule names

• T1566
• T1566.001

Related rules

• 438025f9-5856-4663-83f7-52f878a70a50 (derived)

References

• https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18
• https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml