initial_access_suspicious_dll_loaded_by_microsoft_office_process.yml

name: Suspicious DLL loaded by Microsoft Office process
id: 5868518c-2a83-4b26-ad4b-f14f0b85e744
version: 1.0.0
description:
  Identifies loading of recently dropped DLL by Microsoft Office process.
labels:
  tactic.id: TA0001
  tactic.name: Initial Access
  tactic.ref: https://attack.mitre.org/tactics/TA0001/
  technique.id: T1566
  technique.name: Phishing
  technique.ref: https://attack.mitre.org/techniques/T1566/
  subtechnique.id: T1566.001
  subtechnique.name: Spearphishing Attachment
  subtechnique.ref: https://attack.mitre.org/techniques/T1566/001/

condition: >
  sequence
  maxspan 1h
    |create_file and (file.extension iin module_extensions or file.is_dll) and ps.name iin msoffice_binaries| by file.name
    |load_module and ps.name iin msoffice_binaries| by image.name

min-engine-version: 2.0.0