title: Office Directory Traversal CommandLine
id: 868955d9-697e-45d4-a3da-360cefd7c216
status: experimental
description: Detects Office Applications executing a Windows child process including directory traversal patterns
references:
    - https://twitter.com/sbousseaden/status/1531653369546301440
author: '@SBousseaden (idea), Christian Burkard (rule)'
tags:
  - attack.execution
  - attack.defense_evasion
date: 2022/06/02
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\msaccess.exe'
      - '\mspub.exe'
      - '\eqnedt32.exe'
      - '\visio.exe'
    Image|contains:
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
    CommandLine:
      - '../../../..'
      - '..\..\..\..'
      - '..//..//..//..'
  condition: selection
falsepositives:
  - Unknown
level: high
