IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›SIEM Guide [7.6] ›Detections (Beta) ›Prebuilt rule reference
« Strace Process Activity Suspicious MS Outlook Child Process »

Suspicious MS Office Child Processedit

Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.

Rule indices:

  • winlogbeat-*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum signals per execution: 100

Tags:

  • Elastic
  • Windows

Rule version: 1

Added (Elastic Stack release): 7.6.0

Rule queryedit

event.action:"Process Create (rule: ProcessCreate)" and
process.parent.name:("winword.exe" or "excel.exe" or "powerpnt.exe" or
"eqnedt32.exe" or "fltldr.exe" or "mspub.exe" or "msaccess.exe") and
process.name:("arp.exe" or "dsquery.exe" or "dsget.exe" or
"gpresult.exe" or "hostname.exe" or "ipconfig.exe" or "nbtstat.exe" or
"net.exe" or "net1.exe" or "netsh.exe" or "netstat.exe" or
"nltest.exe" or "ping.exe" or "qprocess.exe" or "quser.exe" or
"qwinsta.exe" or "reg.exe" or "sc.exe" or "systeminfo.exe" or
"tasklist.exe" or "tracert.exe" or "whoami.exe" or "bginfo.exe" or
"cdb.exe" or "cmstp.exe" or "csi.exe" or "dnx.exe" or "fsi.exe" or
"ieexec.exe" or "iexpress.exe" or "installutil.exe" or
"Microsoft.Workflow.Compiler.exe" or "msbuild.exe" or "mshta.exe" or
"msxsl.exe" or "odbcconf.exe" or "rcsi.exe" or "regsvr32.exe" or
"xwizard.exe" or "atbroker.exe" or "forfiles.exe" or "schtasks.exe" or
"regasm.exe" or "regsvcs.exe" or "cmd.exe" or "cscript.exe" or
"powershell.exe" or "pwsh.exe" or "wmic.exe" or "wscript.exe" or
"bitsadmin.exe" or "certutil.exe" or "ftp.exe")

Threat mappingedit

Framework: MITRE ATT&CKTM

« Strace Process Activity Suspicious MS Outlook Child Process »