Excel Macro Execution

Description

Bazacall uses malicious macro-enabled Excel documents to execute their payload.

Query · kql

DeviceProcessEvents
| where InitiatingProcessFileName =~ "excel.exe"
    and ProcessCommandLine has_all('mkdir', '&& copy', 'certutil.exe')
Raw source Excel Macro Execution · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fa2c1c3a-18f8-4c83-8501-ea110873f99f
name: Excel Macro Execution
description: |
  Bazacall uses malicious macro-enabled Excel documents to execute their payload.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  DeviceProcessEvents
  | where InitiatingProcessFileName =~ "excel.exe"
      and ProcessCommandLine has_all('mkdir', '&& copy', 'certutil.exe')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.