File With Uncommon Extension Created By An Office Application

Title: File With Uncommon Extension Created By An Office Application
Status: test
Description:Detects the creation of files with an executable or script extension by an Office application.
References:
  -https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  -https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-08-23
modified:2025-10-17
Tags:

• -'attack.t1204.002'
• -'attack.execution'

Logsource:

• product: windows
• category: file_event

Detection:
  selection1:
    Image|endswith:
      -'\excel.exe'
      -'\msaccess.exe'
      -'\mspub.exe'
      -'\powerpnt.exe'
      -'\visio.exe'
      -'\winword.exe'

  selection2:
    TargetFilename|endswith:
      -'.bat'
      -'.cmd'
      -'.com'
      -'.dll'
      -'.exe'
      -'.hta'
      -'.ocx'
      -'.proj'
      -'.ps1'
      -'.scf'
      -'.scr'
      -'.sys'
      -'.vbe'
      -'.vbs'
      -'.wsf'
      -'.wsh'

  filter_main_localassembly:
    TargetFilename|contains: '\AppData\Local\assembly\tmp\'
    TargetFilename|endswith: '.dll'
  filter_optional_webservicecache:
    TargetFilename|contains|all:
      -'C:\Users\'
      -'\AppData\Local\Microsoft\Office\'
      -'\WebServiceCache\AllUsers'

    TargetFilename|endswith: '.com'
  filter_optional_webex:
    Image|endswith: '\winword.exe'
    TargetFilename|contains: '\AppData\Local\Temp\webexdelta\'
    TargetFilename|endswith:
      -'.dll'
      -'.exe'

  filter_optional_backstageinappnavcache:
    TargetFilename|contains|all:
      -'C:\Users\'
      -'\AppData\Local\Microsoft\Office\'
      -'\BackstageInAppNavCache\'

    TargetFilename|endswith: '.com'
  condition:all of selection* and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high