Detect Malicious File in Splunk
Adversaries rely on users opening malicious files to gain code execution. Files delivered via spearphishing attachments or placed in shared directories include .doc, .xls, .pdf, .rtf, .scr, .exe, .lnk, .pif, .cpl, .iso, and others. Social engineering lures users into enabling macros, extracting archives, or double-clicking payloads. Execution typically manifests as an Office application, PDF reader, or shell process spawning a scripting engine, command interpreter, or LOLBin as a child process.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1204 User Execution
- Sub-technique
- T1204.002 Malicious File
- Canonical reference
- https://attack.mitre.org/techniques/T1204/002/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImageLower=lower(ParentImage)
| eval ImageLower=lower(Image)
| eval CommandLineLower=lower(CommandLine)
| eval IsOfficeParent=if(match(ParentImageLower, "(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|onenote\.exe|mspub\.exe|visio\.exe|wordpad\.exe|acrord32\.exe|foxitreader\.exe)"), 1, 0)
| eval IsSuspiciousChild=if(match(ImageLower, "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|msbuild\.exe|wmic\.exe|installutil\.exe|regasm\.exe|schtasks\.exe)"), 1, 0)
| eval IsScriptInterpreter=if(match(ImageLower, "(wscript\.exe|cscript\.exe|mshta\.exe)"), 1, 0)
| eval IsUserWritablePath=if(match(CommandLineLower, "(appdata\\local\\temp|appdata\\roaming|\\downloads\\|\\desktop\\|\\public\\|windows\\temp)"), 1, 0)
| eval IsScriptExtension=if(match(CommandLineLower, "\.(vbs|vbe|js|jse|wsf|hta|ps1)[\"'\s]"), 1, 0)
| eval IsExplorerParent=if(match(ParentImageLower, "explorer\.exe"), 1, 0)
| eval IsDroppedExec=if(match(ImageLower, "\.(exe|scr|pif|cpl|com)$") AND match(CurrentDirectory, "(temp|downloads|desktop|public)"), 1, 0)
| eval DetectionBranch=case(
IsOfficeParent=1 AND IsSuspiciousChild=1, "Office_SuspiciousChildSpawn",
IsScriptInterpreter=1 AND (IsUserWritablePath=1 OR IsScriptExtension=1), "Script_UserPathExecution",
IsExplorerParent=1 AND IsSuspiciousChild=1 AND IsUserWritablePath=1, "Explorer_SuspiciousChildSpawn",
IsDroppedExec=1, "Dropped_ExecutableRun",
true(), "Unknown")
| where DetectionBranch!="Unknown"
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
DetectionBranch, IsOfficeParent, IsSuspiciousChild, IsScriptInterpreter,
IsUserWritablePath, IsScriptExtension
| sort - _timeDetects malicious file execution using Sysmon Event ID 1 (Process Creation). Evaluates each process creation event across four detection scenarios: Office or PDF applications spawning suspicious child processes (macro execution), script interpreters executing files from user-writeable paths, Explorer spawning suspicious children from temp/download directories (LNK or ISO execution), and dropped executables running from transient user directories. The DetectionBranch field categorises each match for analyst triage.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate macro-enabled documents used by finance or HR teams that spawn cmd.exe or PowerShell for approved business automation
- IT software installation packages that extract and run executables from the user's Downloads or Temp folder
- PDF forms invoking Acrobat helper processes for printing or digital signature workflows
- Developer workstations where build tools are routinely invoked from project directories under AppData
Other platforms for T1204.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Word Document Macro Spawning PowerShell
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=WINWORD.EXE and Image=cmd.exe, CommandLine containing 'whoami'. Security Event ID 4688 (if command line auditing enabled) with same parent-child relationship. Sysmon Event ID 11: File creation of df00tech-macro-test.txt by cmd.exe.
- Test 2VBScript Execution from Downloads Folder
Expected signal: Sysmon Event ID 1: Process Create with Image=wscript.exe, CommandLine containing the path to df00tech-invoice.vbs in the Downloads folder. ParentImage will be cmd.exe (simulating Explorer shell execution). Sysmon Event ID 11: File creation of df00tech-vbs-test.txt by cmd.exe child of wscript.exe.
- Test 3HTA File Execution Simulating Phishing Payload
Expected signal: Sysmon Event ID 1 (first): Process Create for mshta.exe with CommandLine pointing to df00tech-payload.hta in TEMP. Sysmon Event ID 1 (second): cmd.exe as child of mshta.exe with CommandLine containing 'whoami'. Sysmon Event ID 11: File creation of df00tech-hta-test.txt.
- Test 4ISO-Mounted LNK File Executing Payload (MOTW Bypass Simulation)
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=explorer.exe, Image=cmd.exe, with CommandLine containing path to payload.bat. Sysmon Event ID 11: File creation of invoice.lnk and payload.bat in the simulated ISO directory. Sysmon Event ID 11: df00tech-iso-result.txt created by cmd.exe.
References (10)
- https://attack.mitre.org/techniques/T1204/002/
- https://www.bleepingcomputer.com/news/security/psa-dont-open-spam-containing-password-protected-word-docs/
- https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1204.002/T1204.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-how-to-protect-against-this-malware
- https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups/
- https://docs.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
Unlock Pro Content
Get the full detection package for T1204.002 including response playbook, investigation guide, and atomic red team tests.