BIOC
Informational
✕
Office process writes an executable file to disk
An executable file was written by a Microsoft Office application to disk.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution (T1204)
Indicator:
File file name = *.exe , *.bat , *.ps1 , *.sys , *.dll , *.vb , *.vbs AND action type = create Process initiated by = winword.exe , excel.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe
Preventable: yes