Montaser Ismail
@M0nt3xTrusted contributorCompletionist
0 followers4 downloads318 copies1 like847 views
40 detections
Filters
Last updated
All Time
Detection languages
40
Categories
20
10
8
6
5
Platforms
30
7
6
2
1
Products / Services
19
6
4
3
2
MITRE Techniques
14
11
7
6
6
CVEs
2
1
1
1
This detection identifies instances where a Microsoft Office application (Word, Excel, PowerPoint, or Outlook) spawns a child process commonly associated with script execution or living-off-the-land binary (LOLBin) abuse — including wscript.exe, cscript.exe, mshta.exe, powershell.exe, cmd.exe, regsvr32.exe, rundll32.exe, certutil.exe, and bitsadmin.exe.
This behavior is a well-known indicator of malicious macro or embedded-object execution following a phishing lure: a victim opens a weaponized document, and a macro (or OLE/DDE object) launches a script interpreter or LOLBin to download, decode, or execute a second-stage payload. Office applications rarely need to spawn these processes during legitimate use, making this a high-fidelity pivot point for detecting initial access and user-execution activity.
Rationale
Office applications spawning script hosts or command interpreters is atypical for normal document/spreadsheet/presentation workflows.
Threat actors frequently abuse Office macros (VBA), DDE, or OLE objects as an initial access vector, then use LOLBins to evade detection and blend in with legitimate system activity.
Tools like mshta.exe, certutil.exe, and bitsadmin.exe are commonly abused for downloading and executing remote payloads while evading traditional AV/EDR signatures.
MITRE ATT&CK Mapping
Technique Tactic
T1566 (Phishing) Initial Access
T1204 (User Execution) / T1204.002 (Malicious File) Execution
T1059 (Command and Scripting Interpreter) Execution
T1218 (System Binary Proxy Execution) — e.g. T1218.005 Mshta, T1218.010 Regsvr32, T1218.011 Rundll32 Defense Evasion
T1197 (BITS Jobs) Defense Evasion, Persistence
T1140 (Deobfuscate/Decode Files or Information) — via certutil Defense Evasion
Data Source
Microsoft Defender for Endpoint — DeviceProcessEvents
Logic Summary
Flags process creation events over the last 30 days where:
The initiating (parent) process is winword.exe, excel.exe, powerpnt.exe, or outlook.exe, and
The spawned (child) process i
This behavior is a well-known indicator of malicious macro or embedded-object execution following a phishing lure: a victim opens a weaponized document, and a macro (or OLE/DDE object) launches a script interpreter or LOLBin to download, decode, or execute a second-stage payload. Office applications rarely need to spawn these processes during legitimate use, making this a high-fidelity pivot point for detecting initial access and user-execution activity.
Rationale
Office applications spawning script hosts or command interpreters is atypical for normal document/spreadsheet/presentation workflows.
Threat actors frequently abuse Office macros (VBA), DDE, or OLE objects as an initial access vector, then use LOLBins to evade detection and blend in with legitimate system activity.
Tools like mshta.exe, certutil.exe, and bitsadmin.exe are commonly abused for downloading and executing remote payloads while evading traditional AV/EDR signatures.
MITRE ATT&CK Mapping
Technique Tactic
T1566 (Phishing) Initial Access
T1204 (User Execution) / T1204.002 (Malicious File) Execution
T1059 (Command and Scripting Interpreter) Execution
T1218 (System Binary Proxy Execution) — e.g. T1218.005 Mshta, T1218.010 Regsvr32, T1218.011 Rundll32 Defense Evasion
T1197 (BITS Jobs) Defense Evasion, Persistence
T1140 (Deobfuscate/Decode Files or Information) — via certutil Defense Evasion
Data Source
Microsoft Defender for Endpoint — DeviceProcessEvents
Logic Summary
Flags process creation events over the last 30 days where:
The initiating (parent) process is winword.exe, excel.exe, powerpnt.exe, or outlook.exe, and
The spawned (child) process i
Detects network traffic on Microsoft Defender for Endpoint-monitored devices that matches signatures or packet content associated with known vulnerability scanning and penetration-testing tools (e.g. Nmap, Burp Suite, Nessus, Qualys, Metasploit, Nuclei, Shodan). Parses AdditionalFields JSON from DeviceNetworkEvents to inspect SamplePacketContent, SignatureName, and SignatureMatchedContent. Ambiguous common-word tool names (zap, vega, hydra, medusa, retina, intruder) are matched only against the curated SignatureName/SignatureMatchedContent fields to avoid false positives from raw packet content. Excludes traffic from known, sanctioned vulnerability-management scanner IPs to reduce noise from authorized scans.
BITSAdmin Abuse for Download/Persistence (T1197)
This rule detects the loading of kernel-mode drivers that match hashes identified as vulnerable or malicious by the LOLDrivers project. This is a common indicator of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, where adversaries exploit legitimate, signed drivers with known vulnerabilities to gain kernel-mode code execution or elevate privileges.
This rule detects potentially malicious child processes spawned by LOLBins (Living Off the Land Binaries) like mshta.exe, wscript.exe, cscript.exe, rundll32.exe, or regsvr32.exe, which were themselves initiated by document applications (e.g., Office, Acrobat) or common shell interpreters. It specifically identifies downstream payloads that are either unsigned or signed by non-trusted publishers, filtering out Microsoft and common third-party software signers.
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
KQL Query
Double extension masquerading is a defense-evasion technique (cataloged under MITRE ATT&CK T1036.007) where a malicious executable file is disguised with a safe-sounding first extension, such as .pdf.exe or .jpg.scr , etc, to trick users into opening it.
This rule is used to detect suspicious double Extension Masquerading
This rule is used to detect suspicious double Extension Masquerading
KQL Query
This rule detects the use of the Certutil.exe utility with flags commonly associated with adversary techniques such as downloading files, decoding malicious payloads, or manipulating the Windows Certificate Store.
Page 4 of 4