sublimehighRule

Attachment: Malicious OneNote commands

Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.

MITRE ATT&CK

execution

Detection Query

type.inbound
and any(attachments,
        (
          .file_extension in~ ("one")
          or .file_extension in~ $file_extensions_common_archives
        )
        and any(file.explode(.),
                "onenote_file" in .flavors.yara
                and any(.scan.strings.strings,
                        strings.ilike(.,
                                      "*WshShell*",
                                      "*ExecuteCmdAsync*",
                                      "*CreateObject*",
                                      "*Wscript.Shell*",
                                      "*schtasks*",
                                      "*CreateProcess*",
                                      "*winmgmts*",
                                      "*SetEnvironmentVariable*",
                                      "*powershell*",
                                      "*echo off*"
                        )
                )
        )
)

Author

Kyle Parrish

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

Raw Content

name: "Attachment: Malicious OneNote commands"
description: |
  Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.
references:
  - "https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/"
  - "https://bazaar.abuse.ch/sample/aafc0ca9681c1f5c368b0f6da85b90e433f6d62fb34ed2e968e53f83981a800f"
type: "rule"
authors:
  - twitter: "Kyle_Parrish_"
    name: "Kyle Parrish"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          (
            .file_extension in~ ("one")
            or .file_extension in~ $file_extensions_common_archives
          )
          and any(file.explode(.),
                  "onenote_file" in .flavors.yara
                  and any(.scan.strings.strings,
                          strings.ilike(.,
                                        "*WshShell*",
                                        "*ExecuteCmdAsync*",
                                        "*CreateObject*",
                                        "*Wscript.Shell*",
                                        "*schtasks*",
                                        "*CreateProcess*",
                                        "*winmgmts*",
                                        "*SetEnvironmentVariable*",
                                        "*powershell*",
                                        "*echo off*"
                          )
                  )
          )
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "OneNote"
  - "Scripting"
detection_methods:
  - "Archive analysis"
  - "Content analysis"
  - "File analysis"
  - "YARA"
id: "7319f0eb-a3c7-5320-a4ae-6fbf7952369e"