Office ASR rule triggered from browser spawned office process.
Id | 30580043-2451-4d35-b49f-065728529f4a |
Rulename | Office ASR rule triggered from browser spawned office process. |
Description | The attacker sends a spearphishing email to a user. The email contains a link which points to a website that eventually presents the user a download of an MS Office document. This document contains a malicious macro. The macro triggers one of the ASR rules. This detection looks for Office ASR violations triggered by an Office document opened from a browser. Note: be aware that you need to have the proper ASR rules enabled for this detection to work. |
Severity | Medium |
Tactics | InitialAccess |
Techniques | T1566.002 |
Required data connectors | MicrosoftThreatProtection |
Kind | Scheduled |
Query frequency | 5m |
Query period | 5m |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OfficeASRFromBrowser.yaml |
Version | 1.0.0 |
Arm template | 30580043-2451-4d35-b49f-065728529f4a.json |
// Add your own browsers here as well.
let browsers = dynamic(["iexplore.exe", "chrome.exe", "firefox.exe", "msedge.exe"]);
DeviceEvents
| where ActionType contains "Office"
| where InitiatingProcessFileName in~ (browsers) or InitiatingProcessParentFileName in~ (browsers)
// Ignore docx, xlsx and pptx files. These don't contain macros.
| where not(FileName endswith ".docx" or FileName endswith ".xlsx" or FileName endswith ".pptx")
severity: Medium
queryFrequency: 5m
relevantTechniques:
- T1566.002
tactics:
- InitialAccess
kind: Scheduled
query: |
// Add your own browsers here as well.
let browsers = dynamic(["iexplore.exe", "chrome.exe", "firefox.exe", "msedge.exe"]);
DeviceEvents
| where ActionType contains "Office"
| where InitiatingProcessFileName in~ (browsers) or InitiatingProcessParentFileName in~ (browsers)
// Ignore docx, xlsx and pptx files. These don't contain macros.
| where not(FileName endswith ".docx" or FileName endswith ".xlsx" or FileName endswith ".pptx")
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OfficeASRFromBrowser.yaml
queryPeriod: 5m
status: Available
version: 1.0.0
name: Office ASR rule triggered from browser spawned office process.
requiredDataConnectors:
- dataTypes:
- DeviceEvents
connectorId: MicrosoftThreatProtection
triggerOperator: gt
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Sid
columnName: AccountSid
- identifier: Name
columnName: AccountName
- identifier: NTDomain
columnName: AccountDomain
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: DeviceName
- entityType: Process
fieldMappings:
- identifier: CommandLine
columnName: ProcessCommandLine
id: 30580043-2451-4d35-b49f-065728529f4a
description: |
The attacker sends a spearphishing email to a user. The email contains a link which points to a website that eventually
presents the user a download of an MS Office document. This document contains a malicious macro. The macro triggers one of the ASR rules.
This detection looks for Office ASR violations triggered by an Office document opened from a browser.
Note: be aware that you need to have the proper ASR rules enabled for this detection to work.
triggerThreshold: 0
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/30580043-2451-4d35-b49f-065728529f4a')]",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/30580043-2451-4d35-b49f-065728529f4a')]",
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"kind": "Scheduled",
"apiVersion": "2022-11-01-preview",
"properties": {
"displayName": "Office ASR rule triggered from browser spawned office process.",
"description": "The attacker sends a spearphishing email to a user. The email contains a link which points to a website that eventually \npresents the user a download of an MS Office document. This document contains a malicious macro. The macro triggers one of the ASR rules. \nThis detection looks for Office ASR violations triggered by an Office document opened from a browser.\nNote: be aware that you need to have the proper ASR rules enabled for this detection to work. \n",
"severity": "Medium",
"enabled": true,
"query": "// Add your own browsers here as well. \nlet browsers = dynamic([\"iexplore.exe\", \"chrome.exe\", \"firefox.exe\", \"msedge.exe\"]);\nDeviceEvents\n| where ActionType contains \"Office\"\n| where InitiatingProcessFileName in~ (browsers) or InitiatingProcessParentFileName in~ (browsers)\n// Ignore docx, xlsx and pptx files. These don't contain macros.\n| where not(FileName endswith \".docx\" or FileName endswith \".xlsx\" or FileName endswith \".pptx\")\n",
"queryFrequency": "PT5M",
"queryPeriod": "PT5M",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0,
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"InitialAccess"
],
"techniques": [
"T1566.002"
],
"alertRuleTemplateName": "30580043-2451-4d35-b49f-065728529f4a",
"customDetails": null,
"entityMappings": [
{
"fieldMappings": [
{
"columnName": "AccountSid",
"identifier": "Sid"
},
{
"columnName": "AccountName",
"identifier": "Name"
},
{
"columnName": "AccountDomain",
"identifier": "NTDomain"
}
],
"entityType": "Account"
},
{
"fieldMappings": [
{
"columnName": "DeviceName",
"identifier": "FullName"
}
],
"entityType": "Host"
},
{
"fieldMappings": [
{
"columnName": "ProcessCommandLine",
"identifier": "CommandLine"
}
],
"entityType": "Process"
}
],
"templateVersion": "1.0.0",
"status": "Available",
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OfficeASRFromBrowser.yaml"
}
}
]
}