Detect Phishing Document Macro Execution and Initial Access in CrowdStrike LogScale
Despite Microsoft's macro-blocking default settings (Block macros from the internet in Office 2016+, enabled by default since 2022), phishing document macro execution continues to be a primary initial access vector for SMBs. Attackers have adapted: moving to ISO/IMG file containers that strip the Mark-of-the-Web (MOTW) flag, using template injection attacks (DOTM/XLTM), abusing OneNote .one files (dropped in 2023 but resurfaced with .onepkg), and targeting users who have manually disabled macro blocking via Group Policy misconfiguration or social engineering ('Enable content to view this document'). QakBot successors (Pikabot, DarkGate), TA577, and Lazarus Group are documented using this technique against UK SMBs. NCSC 2025 advisory noted macro-based attacks persist in 40% of SMB ransomware intrusions due to inadequate macro restrictions.
MITRE ATT&CK
- Tactic
- Initial Access Execution
LogScale Detection Query
// Alert 1: Office application spawning suspicious child process (macro execution)
#event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)^(winword|excel|powerpnt|outlook|onenote|msaccess|mspub)\.exe$/
| FileName = /(?i)^(cmd|powershell|pwsh|mshta|wscript|cscript|regsvr32|rundll32|certutil|bitsadmin|wmic|msiexec|curl|wget|schtasks)\.exe$/
| HighRisk := if(FileName =~ /(?i)^(mshta|cscript|wscript|regsvr32|certutil|bitsadmin)\.exe$/, "YES", "NO")
| RiskScore := if(HighRisk = "YES", 90, 75)
| ThreatType := "Macro_SuspiciousChildProcess"
| ThreatActors := "Pikabot, DarkGate, TA577, Lazarus Group"
| groupBy(
[ComputerName, UserName, ParentBaseFileName, FileName, HighRisk, RiskScore, ThreatType],
function=[
count(as=EventCount),
values(CommandLine, as=CommandLines),
values(TargetProcessId, as=ChildPIDs),
max(RiskScore, as=MaxRisk)
]
)
| sort(MaxRisk, order=desc)
// Alert 2 (run separately): ISO/VHD file write followed by Office macro execution
// #event_simpleName=/(ProcessRollup2|NewScriptWritten|PeFileWritten)/
// | join(
// {#event_simpleName=/(AsepValueUpdate|PeFileWritten|NewScriptWritten)/
// | FileName =~ /(?i)\.(iso|img|vhd|vhdx)$/
// | groupBy([ComputerName, UserName], function=collect([FileName], as=ContainerFiles))},
// field=[ComputerName, UserName], mode=inner
// )
// | ParentBaseFileName =~ /(?i)^(winword|excel|powerpnt|outlook|onenote|mspub)\.exe$/
// | FileName =~ /(?i)^(cmd|powershell|mshta|wscript|cscript|regsvr32|rundll32|certutil)\.exe$/CrowdStrike LogScale (Falcon NG-SIEM) CQL query detecting Office applications spawning LOLBins or script interpreters using ProcessRollup2 Falcon telemetry events. Applies regex matching on ParentBaseFileName and FileName fields (Falcon normalised process names without path). Assigns risk scores and groups by host/user/process combination to aggregate repeated execution attempts. Covers Pikabot, DarkGate, TA577, and Lazarus Group initial access patterns. A commented-out second query sketches ISO container correlation using file write events; adapt to your Falcon sensor data availability.
Data Sources
Required Tables
False Positives & Tuning
- Automated Excel-based reporting tools used by operations teams that spawn PowerShell for data aggregation — create a LogScale saved search exclusion using a lookup table of approved service account UserName values paired with known-good CommandLine prefixes
- Managed software deployment via Microsoft SCCM or Intune that temporarily spawns Office processes during package installation and may call msiexec.exe or cmd.exe — correlate RiskScore=75 alerts against your change management window schedule and suppress during maintenance periods
- Security awareness training platforms (e.g., KnowBe4, Proofpoint Security Awareness) that deliver simulated phishing documents which may execute macro payloads in sandboxed or monitored environments — exclude by hostname suffix or OU membership if your training uses dedicated test endpoints
Other platforms for THREAT-InitialAccess-PhishingMacro
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Office Macro Child Process Simulation (Excel)
Expected signal: Sysmon Event ID 1: Excel.exe spawning cmd.exe. Parent process chain: explorer.exe > excel.exe > cmd.exe.
References (6)
- https://www.ncsc.gov.uk/guidance/phishing
- https://www.microsoft.com/en-us/security/blog/2022/02/07/macro-based-delivery-of-qakbot/
- https://attack.mitre.org/techniques/T1566/001/
- https://attack.mitre.org/techniques/T1059/005/
- https://github.com/decalage2/oletools
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference
Unlock Pro Content
Get the full detection package for THREAT-InitialAccess-PhishingMacro including response playbook, investigation guide, and atomic red team tests.