Microsoft Office Fetching Remote Content

[rule]
description = """
Identifies when Microsoft Office applications (Word, PowerPoint, Excel) download remote html content followed by
spawning a child process. This behavior matches with some common exploits leveraging malicious office documents for
delivery.
"""
id = "6b3aa7d9-08c6-4091-aa03-715d25b34000"
license = "Elastic License v2"
name = "Microsoft Office Fetching Remote Content"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.24"

query = '''
sequence with maxspan=60s
[registry where process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and
 registry.path : "HKEY_USERS\\*\\Software\\Microsoft\\Office\\*\\Common\\Internet\\Server Cache\\http*" and
 not registry.path : "*https://files.slack.com*"] by process.entity_id
[file where event.action == "creation" and
 file.path : "?:\\Users\\*\\AppData\\*\\Content.MSO\\*" and process.name : ("winword.exe", "excel.exe", "powerpnt.exe") and
 (file.extension : "htm*" or file.Ext.header_bytes : "3c21646f63747970652068746d6c3e0a") and file.size >= 4096] by process.entity_id
[process where event.action == "start" and process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe") and
  not process.executable :
            ("?:\\Windows\\System32\\DWWIN.EXE",
             "?:\\Windows\\SysWOW64\\DWWIN.EXE",
             "?:\\Windows\\System32\\WerFault.exe",
             "?:\\Windows\\SysWOW64\\WerFault.exe",
             "?:\\windows\\splwow64.exe",
             "?:\\Program Files*\\Microsoft Office\\*.EXE",
             "?:\\Program Files*\\Microsoft Office\\root\\vfs\\ProgramFilesCommon*\\Microsoft Shared\\OFFICE??\\ai.exe",
             "?:\\Program Files*\\Microsoft Azure Information Protection\\*.exe",
             "?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\acrotray.exe",
             "?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe")] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 2

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "7.15.0"