critical SPL Windows

Encoded PowerShell Spawned by an Office Application

The classic phishing payload chain. The parent–child relationship is what makes this precise - encoded PowerShell on its own is noise.

Rule source

encoded-powershell-parent-office.spl

index=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
  EventCode=1

``` Encoded PowerShell Spawned by Office Application - T1059.001 ```
``` The parent-child relationship is what makes this precise, not the encoding alone. ```

| eval parent = lower(mvindex(split(ParentImage, "\\"), -1))
| eval child  = lower(mvindex(split(Image, "\\"), -1))

| search parent IN ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
         child  IN ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "mshta.exe")

| rex field=CommandLine "(?i)\s-(?:e|en|enc|encodedcommand)\s+(?<b64>[A-Za-z0-9+/=]{40,})"
| where isnotnull(b64)

| stats count
        min(_time) as first_seen
        max(_time) as last_seen
        values(CommandLine) as command_lines
        by host, User, parent, child

| convert ctime(first_seen) ctime(last_seen)
| sort - count

Required telemetry

Sysmon Event ID 1 / Windows 4688, normalised to the Endpoint data model

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Excel add-ins that legitimately shell out - rare, audit before excluding
Finance macro workbooks - exclude by file hash, never by user

Validation

Atomic Red Team T1566.001 macro detonation in an isolated VLAN

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.