Sigma rule: Suspicious File Created Via OneNote Application

Rule

Title

Suspicious File Created Via OneNote Application

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-02-09

Modified

2023-02-27

File

rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith:
        - '\onenote.exe'
        - '\onenotem.exe'
        - '\onenoteim.exe'
    TargetFilename|contains: '\AppData\Local\Temp\OneNote\'
    TargetFilename|endswith:
        # TODO: Add more suspicious extensions
        - '.bat'
        - '.chm'
        - '.cmd'
        - '.dll'
        - '.exe'
        - '.hta'
        - '.htm'
        - '.html'
        - '.js'
        - '.lnk'
        - '.ps1'
        - '.vbe'
        - '.vbs'
        - '.wsf'
condition: selection

False positives (as the rule lists them)

• False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote.
• Occasional FPs might occur if OneNote is used internally to share different embedded documents

Tags

• attack.stealth

References

• https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
• https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
• https://twitter.com/MaD_c4t/status/1623414582382567424
• https://labs.withsecure.com/publications/detecting-onenote-abuse
• https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/
• https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml