Detect Phishing Document Macro Execution and Initial Access in Sumo Logic CSE
Despite Microsoft's macro-blocking default settings (Block macros from the internet in Office 2016+, enabled by default since 2022), phishing document macro execution continues to be a primary initial access vector for SMBs. Attackers have adapted: moving to ISO/IMG file containers that strip the Mark-of-the-Web (MOTW) flag, using template injection attacks (DOTM/XLTM), abusing OneNote .one files (dropped in 2023 but resurfaced with .onepkg), and targeting users who have manually disabled macro blocking via Group Policy misconfiguration or social engineering ('Enable content to view this document'). QakBot successors (Pikabot, DarkGate), TA577, and Lazarus Group are documented using this technique against UK SMBs. NCSC 2025 advisory noted macro-based attacks persist in 40% of SMB ransomware intrusions due to inadequate macro restrictions.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Sumo Detection Query
(_sourceCategory=*windows*sysmon* OR _sourceCategory=*endpoint* OR _sourceCategory=*wineventlog*)
| where EventID = "1" OR event_id = "1"
| parse field=ParentImage "*\\*" as _parentDir, ParentProcessName nodrop
| parse field=Image "*\\*" as _procDir, ProcessName nodrop
| where ParentProcessName in ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "onenote.exe", "mspub.exe", "msaccess.exe")
| where ProcessName in ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "msiexec.exe", "curl.exe", "wget.exe", "schtasks.exe")
| eval HighRisk = if (ProcessName in ("mshta.exe", "cscript.exe", "wscript.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe"), "YES", "NO")
| eval RiskScore = if (HighRisk = "YES", 90, 75)
| eval ThreatActors = "QakBot successor (Pikabot/DarkGate), TA577, Lazarus Group"
| eval ThreatType = "Macro_SuspiciousChildProcess"
| fields _sourceHost, User, ParentProcessName, ProcessName, CommandLine, RiskScore, HighRisk, ThreatType, ThreatActors
| count by _sourceHost, User, ParentProcessName, ProcessName, HighRisk, RiskScore, ThreatType
| sort - RiskScoreSumo Logic CSE query detecting Microsoft Office applications spawning suspicious child processes consistent with macro-based phishing initial access. Parses Sysmon Event ID 1 fields using Sumo's parse operator to extract ParentProcessName and ProcessName from Image/ParentImage paths. Risk-scores results with 90 for high-risk LOLBins (mshta, cscript, wscript, regsvr32, certutil, bitsadmin) and 75 for others. Covers QakBot successors, Pikabot, DarkGate, TA577, and Lazarus Group delivery patterns.
Data Sources
Required Tables
False Positives & Tuning
- Finance department Excel dashboards with approved macros that invoke PowerShell scripts for data pull from internal APIs — add a Sumo Logic allowlist lookup table of approved automation host/user pairs and join against it to suppress known-good events
- IT support workflows that use Outlook rules to trigger cmd.exe-based scripts for ticket creation or alert forwarding — investigate the CommandLine field; legitimate automation will have static, recognisable argument patterns rather than obfuscated or download-oriented commands
- Legacy line-of-business applications using Word or Excel automation that call regsvr32.exe to register COM components during startup — correlate with software deployment windows and suppress events within change-freeze windows where deployment activity is expected
Other platforms for THREAT-InitialAccess-PhishingMacro
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Office Macro Child Process Simulation (Excel)
Expected signal: Sysmon Event ID 1: Excel.exe spawning cmd.exe. Parent process chain: explorer.exe > excel.exe > cmd.exe.
References (6)
- https://www.ncsc.gov.uk/guidance/phishing
- https://www.microsoft.com/en-us/security/blog/2022/02/07/macro-based-delivery-of-qakbot/
- https://attack.mitre.org/techniques/T1566/001/
- https://attack.mitre.org/techniques/T1059/005/
- https://github.com/decalage2/oletools
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference
Unlock Pro Content
Get the full detection package for THREAT-InitialAccess-PhishingMacro including response playbook, investigation guide, and atomic red team tests.