Detect Malicious File in Elastic Security
Adversaries rely on users opening malicious files to gain code execution. Files delivered via spearphishing attachments or placed in shared directories include .doc, .xls, .pdf, .rtf, .scr, .exe, .lnk, .pif, .cpl, .iso, and others. Social engineering lures users into enabling macros, extracting archives, or double-clicking payloads. Execution typically manifests as an Office application, PDF reader, or shell process spawning a scripting engine, command interpreter, or LOLBin as a child process.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1204 User Execution
- Sub-technique
- T1204.002 Malicious File
- Canonical reference
- https://attack.mitre.org/techniques/T1204/002/
Elastic Detection Query
sequence by host.id with maxspan=2m
[process where event.type == "start" and
process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "onenote.exe", "mspub.exe", "visio.exe", "wordpad.exe", "acrord32.exe", "foxitreader.exe", "sumatra.exe") and
process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msbuild.exe", "wmic.exe", "installutil.exe", "regasm.exe", "regsvcs.exe", "cmstp.exe", "schtasks.exe", "net.exe", "netsh.exe", "curl.exe", "wget.exe")]
[any where true]
| head 500
/* Branch 2: Script interpreter executing from user-writable paths */
process where event.type == "start" and
process.name : ("wscript.exe", "cscript.exe", "mshta.exe") and
(
process.args : ("*\\AppData\\Local\\Temp\\*", "*\\AppData\\Roaming\\*", "*\\Downloads\\*", "*\\Desktop\\*", "*\\Public\\*", "*\\Windows\\Temp\\*") or
process.args : ("*.vbs", "*.vbe", "*.js", "*.jse", "*.wsf", "*.hta", "*.ps1")
)
/* Branch 3: Explorer spawning suspicious children from LNK/ISO context */
process where event.type == "start" and
process.parent.name : "explorer.exe" and
process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msbuild.exe") and
(
process.working_directory : ("*\\AppData\\Local\\Temp\\*", "*\\AppData\\Roaming\\*", "*\\Downloads\\*", "*\\Desktop\\*", "*\\Public\\*", "*\\Windows\\Temp\\*") or
process.parent.args : ("*.lnk")
)
/* Branch 4: Dropped executable launched from user-writable path */
process where event.type == "start" and
process.name : ("*.exe", "*.scr", "*.pif", "*.cpl", "*.com") and
process.executable : ("*\\AppData\\Local\\Temp\\*", "*\\AppData\\Roaming\\*", "*\\Downloads\\*", "*\\Desktop\\*", "*\\Public\\*", "*\\Windows\\Temp\\*") and
process.parent.name : ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "onenote.exe", "acrord32.exe", "foxitreader.exe", "explorer.exe", "winrar.exe", "7z.exe")Detects T1204.002 malicious file execution patterns: Office/PDF applications spawning suspicious child processes (macro execution), script interpreters launching from user-writable paths, Explorer spawning suspicious processes from LNK/ISO context, and dropped executables launched from temp/download locations.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Office macros used by finance or operations teams to automate workflows may trigger Office_SuspiciousChildSpawn — validate against an approved macro inventory and user role.
- IT automation scripts (e.g., SCCM deployment packages, software installers run by IT) legitimately launch executables from Temp/Downloads paths — correlate with change management tickets and software deployment logs.
- Developers using WSL, Node.js, or Python tools installed in AppData may trigger Script_UserPathExecution — verify against developer machine baselines and software asset management.
- PDF readers with JavaScript support (Acrobat) calling internal helper processes or plugin DLLs may generate false positives — check parent-child chain against known Acrobat plugin paths.
Other platforms for T1204.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Word Document Macro Spawning PowerShell
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=WINWORD.EXE and Image=cmd.exe, CommandLine containing 'whoami'. Security Event ID 4688 (if command line auditing enabled) with same parent-child relationship. Sysmon Event ID 11: File creation of df00tech-macro-test.txt by cmd.exe.
- Test 2VBScript Execution from Downloads Folder
Expected signal: Sysmon Event ID 1: Process Create with Image=wscript.exe, CommandLine containing the path to df00tech-invoice.vbs in the Downloads folder. ParentImage will be cmd.exe (simulating Explorer shell execution). Sysmon Event ID 11: File creation of df00tech-vbs-test.txt by cmd.exe child of wscript.exe.
- Test 3HTA File Execution Simulating Phishing Payload
Expected signal: Sysmon Event ID 1 (first): Process Create for mshta.exe with CommandLine pointing to df00tech-payload.hta in TEMP. Sysmon Event ID 1 (second): cmd.exe as child of mshta.exe with CommandLine containing 'whoami'. Sysmon Event ID 11: File creation of df00tech-hta-test.txt.
- Test 4ISO-Mounted LNK File Executing Payload (MOTW Bypass Simulation)
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=explorer.exe, Image=cmd.exe, with CommandLine containing path to payload.bat. Sysmon Event ID 11: File creation of invoice.lnk and payload.bat in the simulated ISO directory. Sysmon Event ID 11: df00tech-iso-result.txt created by cmd.exe.
References (10)
- https://attack.mitre.org/techniques/T1204/002/
- https://www.bleepingcomputer.com/news/security/psa-dont-open-spam-containing-password-protected-word-docs/
- https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1204.002/T1204.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-how-to-protect-against-this-malware
- https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups/
- https://docs.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
Unlock Pro Content
Get the full detection package for T1204.002 including response playbook, investigation guide, and atomic red team tests.