Detect a document or archive application spawning a system utility

Siemphony@siemphonyhighT1204unverified

Matches a document viewer, browser or archive tool spawning one of the living-off-the-land binaries MITRE lists in AN1314 — the two selections are that analytic's HighRiskParents and HighRiskChildren knobs written out and ANDed. AN1314 is a four-stage chain: an application open/click/crash event, a file created in a user-writable path, the LOLBIN child, then egress from the same lineage inside a 15-minute window. Sigma has no process-lineage join and no timeframe, so only stage three is expressed here, and the UserPaths and EgressAllowList knobs have no equivalent in a single process_creation event. explorer.exe is omitted from the parent list despite MITRE naming it, because a user launching cmd.exe or powershell.exe from the shell produces the same event and would drown every real hit. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0478, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\winword.exe" or InitiatingProcessFolderPath endswith "\\excel.exe" or InitiatingProcessFolderPath endswith "\\powerpnt.exe" or InitiatingProcessFolderPath endswith "\\acrord32.exe" or InitiatingProcessFolderPath endswith "\\chrome.exe" or InitiatingProcessFolderPath endswith "\\msedge.exe" or InitiatingProcessFolderPath endswith "\\firefox.exe" or InitiatingProcessFolderPath endswith "\\7zFM.exe" or InitiatingProcessFolderPath endswith "\\winrar.exe") and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\msiexec.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\pcalua.exe" or FolderPath endswith "\\expand.exe" or FolderPath endswith "\\tar.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\acrord32.exe" OR ParentImage="*\\chrome.exe" OR ParentImage="*\\msedge.exe" OR ParentImage="*\\firefox.exe" OR ParentImage="*\\7zFM.exe" OR ParentImage="*\\winrar.exe") AND (Image="*\\powershell.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\msiexec.exe" OR Image="*\\curl.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\pcalua.exe" OR Image="*\\expand.exe" OR Image="*\\tar.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\powerpnt.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\acrord32.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\chrome.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\msedge.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\firefox.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\7zfm.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\winrar.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msiexec.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pcalua.exe" OR TO_LOWER(process.executable) LIKE "*\\\\expand.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tar.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\winword\.exe$|\\excel\.exe$|\\powerpnt\.exe$|\\acrord32\.exe$|\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$|\\7zFM\.exe$|\\winrar\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\msiexec\.exe$|\\curl\.exe$|\\bitsadmin\.exe$|\\pcalua\.exe$|\\expand\.exe$|\\tar\.exe$)</field>    <description>Detect a document or archive application spawning a system utility</description>    <mitre>      <id>T1204</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 190b7574-8f2d-47cd-b1ed-168a3789ab2e

ATT&CKT1204

T1204User Execution

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

A document viewer, browser or archive tool spawning a living-off-the-land binary. The maldoc shape: a user opens an attachment, the macro or exploit runs, and winword.exe becomes the parent of powershell.exe. MITRE's AN1314 is a four-stage chain — (1) a user-facing app records an open/click or abnormal event, (2) a file is created in a user-writable path, (3) the parent app spawns a LOLBIN, (4) egress from the same lineage inside a 15-minute window. Sigma has no process-lineage join and no timeframe, so only stage three is expressed. UserPaths and EgressAllowList, MITRE's knobs for stages two and four, have no equivalent in a single process-creation event.

02 · Telemetry you need

category: process_creation, product: windows. The brief's entry names
Two fields: ParentImage and Image.
Not used: Application channel EventID 1000 (stage one), Sysmon EID 11 (stage

03 · How the logic works

This is the rare rule where the values really are MITRE's. AN1314's HighRiskParents knob enumerates winword, excel, powerpnt, acrord32, chrome/msedge/firefox, 7zFM, winrar and explorer; HighRiskChildren enumerates exactly those thirteen LOLBINs. The child list is verbatim. Elsewhere in this corpus MITRE names the knob and the author supplies the values — here the brief supplied both, and the rule is the two knobs ANDed. Learn to tell the two cases apart; the rest of the corpus depends on you being able to. Why the AND is the rule. high_risk_child alone is "PowerShell started", which is the busiest event on Windows. high_risk_parent alone is "someone opened a document". The pairing is the entire signal — a document has no business being anyone's parent process. The one deliberate deletion, and what it costs. explorer.exe is in MITRE's parent list and the author dropped it, on the grounds that a user launching cmd.exe from the shell produces the same event and would drown every real hit. That is a defensible noise call. It is also the bypass, and the rule does not say so. Standard maldoc tradecraft reparents the child away from the Office process: spawn it through WMI (Win32_Process.Create) and the parent becomes WmiPrvSE.exe; go through the shell COM object and the parent becomes explorer.exe. Neither is in high_risk_parent, neither costs the operator anything, and both leave the attack otherwise unchanged. Excluding explorer.exe for noise reasons documented the evasion without noticing it. Name-only matching. Both selections are Image|endswith with no OriginalFileName companion. Copying powershell.exe to C:\Users\Public\svc.exe defeats the child selection outright. On Sysmon EID 1, OriginalFileName survives a rename and would have held. Scope. The logic is specifically T1204.002 (Malicious File). Nothing here touches T1204.001 (Malicious Link) or T1204.003 (Malicious Image), yet only attack.t1204 is tagged. Be aware too that the winword/excel/powerpnt arms overlap almost exactly with this corpus's T1021.003 rule — one Sysmon EID 1 event will alert twice under two technique IDs.

04 · Common false positives

Browser and reader self-update. Chrome, Edge and Acrobat launch
Browser-launched `rundll32.exe` from ordinary shell operations — printing,
Archive tools opening their payload: a user double-clicking a .msi or setup
Sanctioned Office automation — line-of-business workbooks and mail-merge

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0478 and never executed against a log line. The high level is an assertion about the parent-child pairing, not a measured false-positive rate — and, as above, one its own false-positive block argues against. To reach
tier_2: turn on process-creation auditing, count how often each parent spawns each child over a fortnight, and let the numbers decide the split and the level.
tier_3: restores the chain — document open, file drop in a user-writable path, LOLBIN child, egress from the same lineage — which needs process-lineage tracking and a 15-minute window that Sigma cannot carry.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Split by parent class. Office, Acrobat and the archivers at high; browser
MITRE's `EgressAllowList` knob suppresses updaters downstream at stage four.
MITRE's `HighRiskParents` / `HighRiskChildren` knobs are where the pruning
Add OriginalFileName alternatives for the signed Microsoft children so a
Add attack.t1204.002 to the tags, and consider a lower-level companion on
Knobs with no single-event equivalent: `TimeWindow`, `UserPaths`,

Declared by the author

Browser- and reader-driven updaters. Chrome, Edge and Acrobat launch msiexec.exe or rundll32.exe during self-update and enterprise extension deployment, which is the same parent/child pair the rule looks for. MITRE's EgressAllowList knob suppresses these downstream; at process creation you need a CommandLine exclusion for the vendor's own update package path.
Archive tools opening their payload. A user double-clicking a .bat, .msi or setup stub inside a 7-Zip or WinRAR window legitimately makes 7zFM.exe or winrar.exe the parent of cmd.exe or msiexec.exe during ordinary software installation.
Sanctioned Office automation. Line-of-business workbooks and mail-merge templates whose macros shell out to cmd.exe or cscript.exe to reach a database or a shared drive; these are exactly the entries the analyst is expected to prune out of the HighRiskParents/HighRiskChildren pairing.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — User execution of a rare binary
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1204, evaluated against their process_creation events.

Share this rule

/u/siemphony/190b7574-8f2d-47cd-b1ed-168a3789ab2e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect a document or archive application spawning a system utility

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it