Which SIEM platforms have a THREAT-InitialAccess-PhishingMacro detection rule?

df00tech provides THREAT-InitialAccess-PhishingMacro (Phishing Document Macro Execution and Initial Access) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-InitialAccess-PhishingMacro detection?

The THREAT-InitialAccess-PhishingMacro detection is rated high severity with high confidence.

What are common false positives for THREAT-InitialAccess-PhishingMacro?

Common false positives for THREAT-InitialAccess-PhishingMacro include: Legitimate Office macros that invoke cmd.exe for file management operations (e.g., print macros, export scripts); Developers testing Office automation or VBA scripts who invoke PowerShell from Excel or Word; IT management scripts embedded in Office templates that run system commands (should be replaced with modern automation).

THREAT-InitialAccess-PhishingMacro IBM QRadar · QRadar

Detect Phishing Document Macro Execution and Initial Access in IBM QRadar

Q: What data sources are required to detect Phishing Document Macro Execution and Initial Access (THREAT-InitialAccess-PhishingMacro)?

Detecting Phishing Document Macro Execution and Initial Access requires the following data sources: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceFileEvents), Sysmon Event ID 1, 11, Microsoft 365 Defender.

Despite Microsoft's macro-blocking default settings (Block macros from the internet in Office 2016+, enabled by default since 2022), phishing document macro execution continues to be a primary initial access vector for SMBs. Attackers have adapted: moving to ISO/IMG file containers that strip the Mark-of-the-Web (MOTW) flag, using template injection attacks (DOTM/XLTM), abusing OneNote .one files (dropped in 2023 but resurfaced with .onepkg), and targeting users who have manually disabled macro blocking via Group Policy misconfiguration or social engineering ('Enable content to view this document'). QakBot successors (Pikabot, DarkGate), TA577, and Lazarus Group are documented using this technique against UK SMBs. NCSC 2025 advisory noted macro-based attacks persist in 40% of SMB ransomware intrusions due to inadequate macro restrictions.

MITRE ATT&CK

Tactic: Initial Access Execution

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  username AS Username,
  QIDNAME(qid) AS EventName,
  LOGSOURCENAME(logsourceid) AS LogSource,
  "ParentProcessPath" AS ParentProcess,
  "ProcessPath" AS ChildProcess,
  "CommandLine" AS CommandLine,
  CASE
    WHEN "ProcessPath" ILIKE '%\\mshta.exe'
      OR "ProcessPath" ILIKE '%\\cscript.exe'
      OR "ProcessPath" ILIKE '%\\wscript.exe'
      OR "ProcessPath" ILIKE '%\\regsvr32.exe'
      OR "ProcessPath" ILIKE '%\\certutil.exe'
      OR "ProcessPath" ILIKE '%\\bitsadmin.exe'
    THEN 90
    ELSE 75
  END AS RiskScore,
  CASE
    WHEN "ProcessPath" ILIKE '%\\mshta.exe'
      OR "ProcessPath" ILIKE '%\\cscript.exe'
      OR "ProcessPath" ILIKE '%\\wscript.exe'
      OR "ProcessPath" ILIKE '%\\regsvr32.exe'
      OR "ProcessPath" ILIKE '%\\certutil.exe'
      OR "ProcessPath" ILIKE '%\\bitsadmin.exe'
    THEN 'HIGH'
    ELSE 'MEDIUM'
  END AS Severity
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Sysmon%'
  AND eventid = 1
  AND (
    "ParentProcessPath" ILIKE '%\\winword.exe'
    OR "ParentProcessPath" ILIKE '%\\excel.exe'
    OR "ParentProcessPath" ILIKE '%\\powerpnt.exe'
    OR "ParentProcessPath" ILIKE '%\\outlook.exe'
    OR "ParentProcessPath" ILIKE '%\\onenote.exe'
    OR "ParentProcessPath" ILIKE '%\\mspub.exe'
    OR "ParentProcessPath" ILIKE '%\\msaccess.exe'
  )
  AND (
    "ProcessPath" ILIKE '%\\cmd.exe'
    OR "ProcessPath" ILIKE '%\\powershell.exe'
    OR "ProcessPath" ILIKE '%\\pwsh.exe'
    OR "ProcessPath" ILIKE '%\\mshta.exe'
    OR "ProcessPath" ILIKE '%\\wscript.exe'
    OR "ProcessPath" ILIKE '%\\cscript.exe'
    OR "ProcessPath" ILIKE '%\\regsvr32.exe'
    OR "ProcessPath" ILIKE '%\\rundll32.exe'
    OR "ProcessPath" ILIKE '%\\certutil.exe'
    OR "ProcessPath" ILIKE '%\\bitsadmin.exe'
    OR "ProcessPath" ILIKE '%\\wmic.exe'
    OR "ProcessPath" ILIKE '%\\msiexec.exe'
    OR "ProcessPath" ILIKE '%\\curl.exe'
    OR "ProcessPath" ILIKE '%\\schtasks.exe'
  )
LAST 24 HOURS
ORDER BY RiskScore DESC, starttime DESC

high severity high confidence

QRadar AQL query detecting Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Publisher, Access) spawning LOLBins and script interpreters via Sysmon Event ID 1 (Process Create). Assigns risk scores of 90 for high-risk child processes (mshta, cscript, wscript, regsvr32, certutil, bitsadmin) and 75 for other suspicious children. Requires Sysmon custom properties ParentProcessPath, ProcessPath, and CommandLine to be mapped in QRadar DSM.

Data Sources

IBM QRadar SIEMMicrosoft Sysmon via Windows Event Log (Event ID 1)QRadar DSM with custom Sysmon property extraction

Required Tables

events

False Positives & Tuning

Automated report generation workflows using Excel with macros that call cmd.exe or PowerShell to execute batch file post-processing — create a QRadar building block to exclude known service account usernames (e.g., SVC_REPORTS) from this rule
Software deployment tools (PDQ Deploy, SCCM) that open Office documents during package installation and may spawn cmd.exe — exclude by source IP ranges of deployment servers in the WHERE clause
Third-party Office add-ins (e.g., DocuSign, Adobe, Salesforce for Outlook) that use embedded scripts or helper executables — review CommandLine values and whitelist specific signed binaries with known-good argument patterns

Download portable Sigma rule (.yml)

Other platforms for THREAT-InitialAccess-PhishingMacro

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Office Macro Child Process Simulation (Excel)
Expected signal: Sysmon Event ID 1: Excel.exe spawning cmd.exe. Parent process chain: explorer.exe > excel.exe > cmd.exe.

Last updated: 2026-04-25 Research depth: deep

References (6)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for THREAT-InitialAccess-PhishingMacro including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Parent Technique

T1566.001Spearphishing Attachment

Related Techniques

T1566.001Spearphishing Attachment T1059.005Visual Basic T1204.002Malicious File T1027.006HTML Smuggling T1553.005Mark-of-the-Web Bypass T1547.001Registry Run Keys / Startup Folder

Detect Phishing Document Macro Execution and Initial Access in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for THREAT-InitialAccess-PhishingMacro

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for THREAT-InitialAccess-PhishingMacro

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox