Office Application Creates Executable or Script File
Detects the creation of files with executable or script extensions by Microsoft Office applications. This behavior can indicate an attempt to drop and execute malicious code, often associated with initial access or execution phases of an attack. The rule specifically looks for common Office applications creating files with extensions like .exe, .dll, .ps1, .vbs, etc., while filtering out known legitimate activities.
Sigma
