Detecting Malicious OneNote Attachments

During the 2023 wave of OneNote abuse, attackers embedded scripts, executables and shortcuts in .one notebooks and placed a decoy graphic over them, so a double-click on a button ran the hidden file. Microsoft has since extended blocked-extension handling for embedded files, but notebooks remain a delivery format worth covering.

Signals at a Glance

Execution From the Export Path

When a user opens an embedded file, OneNote writes it to a temporary export directory and launches it. That sequence gives two independent detections: the interpreter whose parent is OneNote, and any execution from the export path:

title: OneNote Spawns Script Host or Interpreter
logsource:
  product: windows
  category: process_creation
detection:
  parent:
    ParentImage|endswith: '\onenote.exe'
  child:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
  from_export:
    Image|contains|all:
      - '\OneNote\'
      - '\Exported\'
  condition: parent and child or from_export
level: high
# tune/validate: confirm the export path pattern on your Office build; legitimate OneNote add-ins rarely launch interpreters.

Reducing the Surface

Hunt delivery in message trace and constrain what the application will open. Most organisations have little business need for externally sourced notebooks:

index=email sourcetype=o365:messagetrace
| eval ext=lower(mvindex(split(AttachmentName, "."), -1))
| where ext="one" OR ext="onetoc2"
| stats count dc(RecipientAddress) as recipients values(SenderAddress) as senders by AttachmentName, SHA256
| where recipients >= 1
| sort - recipients
# tune/validate: field names depend on your O365 add-on and gateway; enrich with first-contact status of the sender.

• Block or quarantine .one attachments from external senders at the gateway unless a team has a documented need.
• Keep Office up to date so extended blocked-extension handling for embedded files applies.
• Treat an embedded-file warning dialog that users click through as an awareness signal worth a short training item.