Suspicious Executable or Script File Creation via OneNote

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•21

Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.