Sysmon - Event 1: Process - MS RCE Follina Detection. · win.eventdata.parentImage = (?i)^C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Off…

Description

field win.eventdata.parentImage="(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD\.EXE$|(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\POWERPNT\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD\.EXE$"

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 60000 Group of windows rules. anchor level 0
   decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
2. 60004 Group of Windows rules for the sysmon channel. anchor level 0
   field win.system.channel="^Microsoft-Windows-Sysmon/Operational$"
3. 61600 Windows Sysmon informational event anchor level 0
   field win.system.severityValue="^INFORMATION$"
4. 61603 Sysmon - Event 1: Process creation · win.system.eventID = 1 anchor level 0
   field win.system.eventID="^1$"
5. 100100 Sysmon - Event 1: Process creation · rule 100100 anchor level 3
   Matches no fields of its own.
6. 100135 Sysmon - Event 1: Process creation · Signed Binary Proxy Execution (T1218) anchor level 3
   field win.eventdata.ruleName="^technique_id=T1218,technique_name=Signed Binary Proxy Execution$"
7. 100508 Sysmon - Event 1: Process creation · win.eventdata.parentImage = winword.exe$|excel.exe$|powerpnt.exe anchor level 10
   field win.eventdata.parentImage="winword.exe$|excel.exe$|powerpnt.exe$"
8. 900109 Sysmon - Event 1: Process - MS RCE Follina Detection. · win.eventdata.parentImage = (?i)^C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Off… exclusion level 10 this rule
   field win.eventdata.parentImage="(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD\.EXE$|(?i)^C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\POWERPNT\.EXE$|(?i)^C:\\\\Program Files \(x86\)\\\\Microsoft Office\\\\root\\\\Office16\\\\WINWORD\.EXE$"

Rule dependencies

Depends on

• composes · Wazuh if_sid 100508
  • Sysmon - Event 1: Process creation · win.eventdata.parentImage = winword.exe$|excel.exe$|powerpnt.exe