Excel Web Query file created on disk

BIOC Informational

Excel Web Query file created on disk

Excel uses Excel Web Query (.iqy) files to download data from the internet. There are campaigns in which .iqy files download a PowerShell script, which is launched via Excel and kicks off a chain of malicious downloads.

Module:: Platform Analytics
Agent event type:: File
Category:: Infiltration
Status:: Enabled

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Phishing: Spearphishing Attachment (T1566.001)

Indicator:

File file name = *.iqy AND action type = create

Preventable: yes