Suspicious File Download from Microsoft Office Domains

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•3•0•30

Detects suspicious attempts to download files from legitimate Microsoft domains (Outlook and OneNote) using command-line tools or PowerShell. Adversaries may leverage these trusted domains to host malicious files, bypassing traditional perimeter defenses and making the activity appear legitimate. The rule specifically looks for common download utilities like curl, wget, Invoke-WebRequest, and Start-BitsTransfer in conjunction with specific Microsoft attachment/sync domains.