Potential Arbitrary File Download Using Office Application

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects the potential for arbitrary file downloads initiated by Microsoft Office applications (Excel, PowerPoint, Word). It specifically looks for instances where these applications are executed and their command line arguments contain HTTP or HTTPS URLs, indicating an attempt to download content from the internet. This behavior can be abused by adversaries to fetch malicious payloads.