High Severity

Attachment: Malicious OneNote Commands

Labels

Description

Scans for OneNote attachments that contain suspicious commands that may indicate malicious activity.

References

https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/

https://bazaar.abuse.ch/sample/aafc0ca9681c1f5c368b0f6da85b90e433f6d62fb34ed2e968e53f83981a800f

@Kyle_Parrish_

Created Aug 17th, 2023 • Last updated Aug 21st, 2023

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        (.file_extension in~ ("one") or .file_extension in~ $file_extensions_common_archives)
        and any(file.explode(.),
                "onenote_file" in .flavors.yara
                and any(.scan.strings.strings,
                        strings.ilike(.,
                                      "*WshShell*",
                                      "*ExecuteCmdAsync*",
                                      "*CreateObject*",
                                      "*Wscript.Shell*",
                                      "*schtasks*",
                                      "*CreateProcess*",
                                      "*winmgmts*",
                                      "*SetEnvironmentVariable*",
                                      "*powershell*",
                                      "*echo off*"
                        )
                )
        )
)

MQL Console

•

View MQL Guide

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.