Detect Phishing Document Macro Execution and Initial Access in IBM QRadar
Despite Microsoft's macro-blocking default settings (Block macros from the internet in Office 2016+, enabled by default since 2022), phishing document macro execution continues to be a primary initial access vector for SMBs. Attackers have adapted: moving to ISO/IMG file containers that strip the Mark-of-the-Web (MOTW) flag, using template injection attacks (DOTM/XLTM), abusing OneNote .one files (dropped in 2023 but resurfaced with .onepkg), and targeting users who have manually disabled macro blocking via Group Policy misconfiguration or social engineering ('Enable content to view this document'). QakBot successors (Pikabot, DarkGate), TA577, and Lazarus Group are documented using this technique against UK SMBs. NCSC 2025 advisory noted macro-based attacks persist in 40% of SMB ransomware intrusions due to inadequate macro restrictions.
MITRE ATT&CK
- Tactic
- Initial Access Execution
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
sourceip AS SourceIP,
username AS Username,
QIDNAME(qid) AS EventName,
LOGSOURCENAME(logsourceid) AS LogSource,
"ParentProcessPath" AS ParentProcess,
"ProcessPath" AS ChildProcess,
"CommandLine" AS CommandLine,
CASE
WHEN "ProcessPath" ILIKE '%\\mshta.exe'
OR "ProcessPath" ILIKE '%\\cscript.exe'
OR "ProcessPath" ILIKE '%\\wscript.exe'
OR "ProcessPath" ILIKE '%\\regsvr32.exe'
OR "ProcessPath" ILIKE '%\\certutil.exe'
OR "ProcessPath" ILIKE '%\\bitsadmin.exe'
THEN 90
ELSE 75
END AS RiskScore,
CASE
WHEN "ProcessPath" ILIKE '%\\mshta.exe'
OR "ProcessPath" ILIKE '%\\cscript.exe'
OR "ProcessPath" ILIKE '%\\wscript.exe'
OR "ProcessPath" ILIKE '%\\regsvr32.exe'
OR "ProcessPath" ILIKE '%\\certutil.exe'
OR "ProcessPath" ILIKE '%\\bitsadmin.exe'
THEN 'HIGH'
ELSE 'MEDIUM'
END AS Severity
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Sysmon%'
AND eventid = 1
AND (
"ParentProcessPath" ILIKE '%\\winword.exe'
OR "ParentProcessPath" ILIKE '%\\excel.exe'
OR "ParentProcessPath" ILIKE '%\\powerpnt.exe'
OR "ParentProcessPath" ILIKE '%\\outlook.exe'
OR "ParentProcessPath" ILIKE '%\\onenote.exe'
OR "ParentProcessPath" ILIKE '%\\mspub.exe'
OR "ParentProcessPath" ILIKE '%\\msaccess.exe'
)
AND (
"ProcessPath" ILIKE '%\\cmd.exe'
OR "ProcessPath" ILIKE '%\\powershell.exe'
OR "ProcessPath" ILIKE '%\\pwsh.exe'
OR "ProcessPath" ILIKE '%\\mshta.exe'
OR "ProcessPath" ILIKE '%\\wscript.exe'
OR "ProcessPath" ILIKE '%\\cscript.exe'
OR "ProcessPath" ILIKE '%\\regsvr32.exe'
OR "ProcessPath" ILIKE '%\\rundll32.exe'
OR "ProcessPath" ILIKE '%\\certutil.exe'
OR "ProcessPath" ILIKE '%\\bitsadmin.exe'
OR "ProcessPath" ILIKE '%\\wmic.exe'
OR "ProcessPath" ILIKE '%\\msiexec.exe'
OR "ProcessPath" ILIKE '%\\curl.exe'
OR "ProcessPath" ILIKE '%\\schtasks.exe'
)
LAST 24 HOURS
ORDER BY RiskScore DESC, starttime DESCQRadar AQL query detecting Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Publisher, Access) spawning LOLBins and script interpreters via Sysmon Event ID 1 (Process Create). Assigns risk scores of 90 for high-risk child processes (mshta, cscript, wscript, regsvr32, certutil, bitsadmin) and 75 for other suspicious children. Requires Sysmon custom properties ParentProcessPath, ProcessPath, and CommandLine to be mapped in QRadar DSM.
Data Sources
Required Tables
False Positives & Tuning
- Automated report generation workflows using Excel with macros that call cmd.exe or PowerShell to execute batch file post-processing — create a QRadar building block to exclude known service account usernames (e.g., SVC_REPORTS) from this rule
- Software deployment tools (PDQ Deploy, SCCM) that open Office documents during package installation and may spawn cmd.exe — exclude by source IP ranges of deployment servers in the WHERE clause
- Third-party Office add-ins (e.g., DocuSign, Adobe, Salesforce for Outlook) that use embedded scripts or helper executables — review CommandLine values and whitelist specific signed binaries with known-good argument patterns
Other platforms for THREAT-InitialAccess-PhishingMacro
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Office Macro Child Process Simulation (Excel)
Expected signal: Sysmon Event ID 1: Excel.exe spawning cmd.exe. Parent process chain: explorer.exe > excel.exe > cmd.exe.
References (5)
Response Playbook
Triage
- Identify the Office document that spawned the suspicious child process. Check the parent process command line for the document file path.
- Locate the document on disk and hash it — look up the hash in VirusTotal and your threat intelligence platform.
- Determine how the document arrived on the endpoint: email attachment (check Outlook message store, O365 email logs), downloaded from web (check browser history), or copied from a network share or USB.
- If the document executed a network callout (certutil download, curl, PowerShell IEX), check network logs for the destination IP/domain and any files downloaded.
- Assess if post-exploitation activity followed: was a payload dropped? Was there persistence (scheduled tasks, registry run keys, startup folders)?
Containment
- Isolate the affected endpoint via EDR host isolation.
- If the macro downloaded a payload: block the C2 domain/IP at the firewall and email gateway.
- Check for lateral movement from the affected host: did it connect to other internal systems after the macro execution?
- Verify macro settings via Group Policy: ensure 'Block macros from the internet' is enforced. Check if the user received a 'click here to enable macros' prompt.
- Quarantine the phishing document and submit to email vendor for blocklisting.
Evidence Collection
- The phishing document itself: hash for VirusTotal, decompile macros with oletools (olevba) for analysis
- Sysmon Event ID 1: child process command line showing what the macro executed
- Browser/email history to determine document delivery vector
- Network flow logs: outbound connections from the Office process to C2
- File system: any dropped payloads, persistence artifacts
Escalation Criteria
- !Macro executed a download cradle (certutil, curl, PowerShell IEX) and dropped a second-stage payload
- !Persistence mechanisms created: scheduled tasks, registry run keys, startup folder files
- !Network connections to external IPs from Office process post-macro execution
- !Multiple endpoints affected by the same phishing document (campaign-level response required)
- !Macro executed in context of a privileged user account
Investigation Guide
Related Techniques
Forensic Artifacts
- >
The Office document: extract VBA macros with olevba, check for auto-execute macros (AutoOpen, AutoClose, Document_Open) - >
Recent file locations: HKCU\Software\Microsoft\Office\[version]\[app]\File MRU - >
Sysmon Event ID 11: files created by Office process after macro execution - >
Sysmon Event ID 3: network connections from Office process - >
Temp directory: C:\Users\[user]\AppData\Local\Temp\ — dropped payload staging location
Tuning Guidance
This detection benefits from understanding your environment's legitimate Office macro usage. In most SMBs, Office macros spawning cmd.exe or PowerShell is genuinely rare and has almost no legitimate business use case in standard user operations. IT-deployed Excel templates with VBA automation should be signed with a code signing certificate and excluded by certificate rather than by process name. Enable Office Macro security telemetry via Microsoft 365 Defender Attack Surface Reduction rules — particularly 'Block all Office applications from creating child processes' which will both prevent and alert on this technique.
Hunting Queries
Hunt for any historical Office → shell/script child process executions over the past 7 days — may reveal prior compromise that was missed or a long dwell time attacker.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "mshta.exe", "certutil.exe", "regsvr32.exe")
| project Timestamp, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
ParentImage IN ("*winword*","*excel*","*powerpnt*","*outlook*")
Image IN ("*cmd*","*powershell*","*wscript*","*mshta*","*certutil*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeAtomic Red Team Tests
Opens an Excel spreadsheet with an auto-execute macro that spawns cmd.exe — simulates the most common phishing document initial access pattern.
Command
powershell.exe -Command "$xl = New-Object -ComObject Excel.Application; $xl.Visible=$false; $wb=$xl.Workbooks.Add(); $ws=$wb.Sheets(1); $m=$wb.VBProject.VBComponents('ThisWorkbook').CodeModule; $m.AddFromString('Private Sub Workbook_Open()\r\nShell \"cmd.exe /c whoami > C:\\Temp\\macro_test.txt\"\'\r\nEnd Sub'); $xl.DisplayAlerts=$false; $wb.SaveAs('C:\\Temp\\test_macro.xlsm',52); $xl.Quit()"Cleanup
Remove-Item C:\Temp\test_macro.txt,C:\Temp\test_macro.xlsm -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Excel.exe spawning cmd.exe. Parent process chain: explorer.exe > excel.exe > cmd.exe.
Expected Detection
Alert fires on Office app (excel.exe) spawning cmd.exe as child process. RiskScore=75.