Malicious Office Document Written to Network Share

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•8

This rule detects when a file with the '.docm' extension is written to a network share via SMB. The presence of '.docm' suggests a macro-enabled Office document, which is often used in malicious campaigns. The rule specifically looks for the content '.docm' and a backslash character ('\') within the SMB traffic, indicating a file path or content related to a document.