Detecting Malicious Attachment Execution

Attackers rotate attachment formats constantly — macro documents, ISO files, shortcuts, PDFs, archives — but the moment of execution looks much the same. A document viewer or mail client becomes the parent of a shell, script host or LOLBin. This pack puts the parent-child logic first and adds gateway context so you can judge the result.

Signals at a Glance

Parent-Child Logic

Legitimate Office and PDF workflows almost never launch a command interpreter. Alert on the relationship rather than the file name, and keep the parent list broad enough to cover the mail client itself:

title: Document Viewer or Mail Client Spawns Shell or Script Host
logsource:
  product: windows
  category: process_creation
detection:
  parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\acrord32.exe'
      - '\acrobat.exe'
      - '\foxitreader.exe'
  child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: parent and child
level: high
# tune/validate: some add-ins and DRM or signing plugins launch helpers; exclude by full command line, not by parent.

Outlook Cache and Message Trace

When a user opens an attachment directly from the mail client, Outlook writes it to a randomised folder under its secure temp location. Code that runs from there was opened without being saved first, which is rare for anything legitimate beyond documents and images:

index=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
  Image="*\\Content.Outlook\\*"
  NOT (Image="*.pdf" OR Image="*.docx" OR Image="*.xlsx")
| stats count min(_time) as first_seen values(CommandLine) as cmd values(ParentImage) as parent by host, User, Image
| sort - count
# tune/validate: Image is the executable, so any hit here is code, not a document. Confirm the field mapping in your Sysmon TA.

• Pair every execution hit with message trace: find the delivering message by recipient and time, then pull sender, subject, attachment hash and gateway verdict.
• Flag attachment extensions that are rare for the recipient's department. Finance receiving a script or disk image is a stronger lead than the same file reaching IT.
• Treat a delayed verdict as a hunting prompt. Check whether the gateway re-scored or retracted the message after delivery, then search for other recipients of the same hash.
• Detonate unknown attachments in a sandbox before delivery where your gateway supports it, and keep the execution rules as the backstop for what slips through.