initial_access_macro_execution_via_script_interpreter.yml

name: Macro execution via script interpreter
id: 845404de-df6f-472f-bd74-72148a7f5166
version: 1.0.0
description: |
  Identifies the execution of the Windows scripting interpreter spawning
  a Microsoft Office process to execute suspicious Visual Basic macro.
labels:
  tactic.id: TA0001
  tactic.name: Initial Access
  tactic.ref: https://attack.mitre.org/tactics/TA0001/
  technique.id: T1566
  technique.name: Phishing
  technique.ref: https://attack.mitre.org/techniques/T1566/
  subtechnique.id: T1566.001
  subtechnique.name: Spearphishing Attachment
  subtechnique.ref: https://attack.mitre.org/techniques/T1566/001/

condition: >
  sequence
  maxspan 5m
    |spawn_process and ps.parent.name iin script_interpreters and ps.child.name iin msoffice_binaries| by ps.child.uuid
    |ps.name iin msoffice_binaries and thread.callstack.modules imatches '*vbe?.dll'
      and
     (
      spawn_process
        or
      (create_remote_thread)
        or
      (modify_registry)
        or
      (create_file)
        or
      (
        load_module and not image.name imatches ('?:\\Program Files\\*', '?:\\Program Files (x86)\\*')
      )
     )
    | by ps.uuid

min-engine-version: 2.2.0