Detect Malicious File in Sumo Logic CSE
Adversaries rely on users opening malicious files to gain code execution. Files delivered via spearphishing attachments or placed in shared directories include .doc, .xls, .pdf, .rtf, .scr, .exe, .lnk, .pif, .cpl, .iso, and others. Social engineering lures users into enabling macros, extracting archives, or double-clicking payloads. Execution typically manifests as an Office application, PDF reader, or shell process spawning a scripting engine, command interpreter, or LOLBin as a child process.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1204 User Execution
- Sub-technique
- T1204.002 Malicious File
- Canonical reference
- https://attack.mitre.org/techniques/T1204/002/
Sumo Detection Query
// Branch 1: Office/PDF parent spawning suspicious child processes
(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where EventID = "1"
| parse field=ParentImage "*\\*" as _unused, ParentImageName nodrop
| parse field=Image "*\\*" as _unused2, ChildImageName nodrop
| toLowerCase(ParentImageName) as ParentImageLower
| toLowerCase(ChildImageName) as ChildImageLower
| toLowerCase(CommandLine) as CommandLineLower
// Classify parent type
| if (ParentImageLower matches "*winword.exe*" OR ParentImageLower matches "*excel.exe*" OR ParentImageLower matches "*powerpnt.exe*" OR ParentImageLower matches "*outlook.exe*" OR ParentImageLower matches "*onenote.exe*" OR ParentImageLower matches "*mspub.exe*" OR ParentImageLower matches "*acrord32.exe*" OR ParentImageLower matches "*foxitreader.exe*" OR ParentImageLower matches "*wordpad.exe*", 1, 0) as IsOfficeParent
// Classify child suspicion
| if (ChildImageLower matches "*cmd.exe*" OR ChildImageLower matches "*powershell.exe*" OR ChildImageLower matches "*pwsh.exe*" OR ChildImageLower matches "*wscript.exe*" OR ChildImageLower matches "*cscript.exe*" OR ChildImageLower matches "*mshta.exe*" OR ChildImageLower matches "*rundll32.exe*" OR ChildImageLower matches "*regsvr32.exe*" OR ChildImageLower matches "*certutil.exe*" OR ChildImageLower matches "*bitsadmin.exe*" OR ChildImageLower matches "*msbuild.exe*" OR ChildImageLower matches "*wmic.exe*" OR ChildImageLower matches "*installutil.exe*", 1, 0) as IsSuspiciousChild
// Classify script interpreter
| if (ChildImageLower matches "*wscript.exe*" OR ChildImageLower matches "*cscript.exe*" OR ChildImageLower matches "*mshta.exe*", 1, 0) as IsScriptInterpreter
// Classify user-writable path
| if (CommandLineLower matches "*appdata\\local\\temp*" OR CommandLineLower matches "*appdata\\roaming*" OR CommandLineLower matches "*\\downloads\\*" OR CommandLineLower matches "*\\desktop\\*" OR CommandLineLower matches "*\\public\\*" OR CommandLineLower matches "*windows\\temp*", 1, 0) as IsUserWritablePath
// Classify script extension
| if (CommandLineLower matches "*.vbs*" OR CommandLineLower matches "*.vbe*" OR CommandLineLower matches "*.js*" OR CommandLineLower matches "*.jse*" OR CommandLineLower matches "*.wsf*" OR CommandLineLower matches "*.hta*" OR CommandLineLower matches "*.ps1*", 1, 0) as IsScriptExtension
// Classify explorer parent
| if (ParentImageLower matches "*explorer.exe*", 1, 0) as IsExplorerParent
// Classify dropped executable
| if ((CommandLineLower matches "*.exe" OR CommandLineLower matches "*.scr" OR CommandLineLower matches "*.pif" OR CommandLineLower matches "*.cpl") AND IsUserWritablePath = 1 AND (IsOfficeParent = 1 OR ParentImageLower matches "*winrar.exe*" OR ParentImageLower matches "*7z.exe*"), 1, 0) as IsDroppedExec
// Determine detection branch
| if (IsOfficeParent = 1 AND IsSuspiciousChild = 1, "Office_SuspiciousChildSpawn",
if (IsScriptInterpreter = 1 AND (IsUserWritablePath = 1 OR IsScriptExtension = 1), "Script_UserPathExecution",
if (IsExplorerParent = 1 AND IsSuspiciousChild = 1 AND IsUserWritablePath = 1, "LnkIso_ShellExecution",
if (IsDroppedExec = 1, "Dropped_ExecutableRun", "Unknown")))) as DetectionBranch
| where DetectionBranch != "Unknown"
| fields _messageTime, Computer, User, ChildImageName, CommandLine, ParentImageName, ParentCommandLine, DetectionBranch, IsOfficeParent, IsSuspiciousChild, IsScriptInterpreter, IsUserWritablePath, IsScriptExtension
| sort by _messageTime descSumo Logic search detecting T1204.002 malicious file execution patterns using Sysmon Event ID 1 (Process Create). Identifies Office/PDF applications spawning suspicious child processes, script interpreters executing from user-writable paths, Explorer spawning suspicious processes from LNK/ISO context, and dropped executables launched from user-accessible directories.
Data Sources
Required Tables
False Positives & Tuning
- Business process automation using licensed Office macros (e.g., Excel-triggered VBA that shells out to run Python scripts in AppData) will trigger Office_SuspiciousChildSpawn — create suppression rules scoped to known automation service accounts and verified macro hashes.
- Third-party software updaters (Adobe, Chrome, Java) that extract and execute files from Temp directories via Explorer or a launcher will trigger Dropped_ExecutableRun or LnkIso_ShellExecution — maintain a software update baseline and correlate with scheduled update windows.
- Security tools or EDR agents that spawn command interpreters for live response or scanning (e.g., CrowdStrike RTR, Carbon Black Live Response) may trigger Script_UserPathExecution — allowlist by process signing certificate and known EDR parent process names.
Other platforms for T1204.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Word Document Macro Spawning PowerShell
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=WINWORD.EXE and Image=cmd.exe, CommandLine containing 'whoami'. Security Event ID 4688 (if command line auditing enabled) with same parent-child relationship. Sysmon Event ID 11: File creation of df00tech-macro-test.txt by cmd.exe.
- Test 2VBScript Execution from Downloads Folder
Expected signal: Sysmon Event ID 1: Process Create with Image=wscript.exe, CommandLine containing the path to df00tech-invoice.vbs in the Downloads folder. ParentImage will be cmd.exe (simulating Explorer shell execution). Sysmon Event ID 11: File creation of df00tech-vbs-test.txt by cmd.exe child of wscript.exe.
- Test 3HTA File Execution Simulating Phishing Payload
Expected signal: Sysmon Event ID 1 (first): Process Create for mshta.exe with CommandLine pointing to df00tech-payload.hta in TEMP. Sysmon Event ID 1 (second): cmd.exe as child of mshta.exe with CommandLine containing 'whoami'. Sysmon Event ID 11: File creation of df00tech-hta-test.txt.
- Test 4ISO-Mounted LNK File Executing Payload (MOTW Bypass Simulation)
Expected signal: Sysmon Event ID 1: Process Create with ParentImage=explorer.exe, Image=cmd.exe, with CommandLine containing path to payload.bat. Sysmon Event ID 11: File creation of invoice.lnk and payload.bat in the simulated ISO directory. Sysmon Event ID 11: df00tech-iso-result.txt created by cmd.exe.
References (10)
- https://attack.mitre.org/techniques/T1204/002/
- https://www.bleepingcomputer.com/news/security/psa-dont-open-spam-containing-password-protected-word-docs/
- https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1204.002/T1204.002.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-how-to-protect-against-this-malware
- https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups/
- https://docs.microsoft.com/en-us/deployoffice/security/internet-macros-blocked
Unlock Pro Content
Get the full detection package for T1204.002 including response playbook, investigation guide, and atomic red team tests.