Find sigma rule 
Attack: Command and Scripting Interpreter: Visual Basic
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)
Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript)
Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).(Citation: Default VBS macros Blocking )
MITRE
Tactic
- execution
technique
- T1059.005
Test : Encoded VBS code execution
OS
- windows
Description:
This module takes an encoded VBS script and executes it from within a malicious document. By default, upon successful execution a message box will pop up displaying “ART T1059.005”
A note regarding this module, due to the way that this module utilizes “ScriptControl” a 64bit version of Microsoft Office is required. You can validate this by opening WinWord -> File -> Account -> About Word
Executor
powershell
Sigma Rule
-
image_load_office_vbadll_load.yml (id: e6ce8457-68b1-485b-9bdd-3c2b5d679aa9)
-
proc_creation_win_office_susp_child_processes.yml (id: 438025f9-5856-4663-83f7-52f878a70a50)
-
proc_creation_win_mshta_susp_pattern.yml (id: e32f92d1-523e-49c3-9374-bdb13b46a3ba)
-
proc_creation_win_mshta_susp_execution.yml (id: cc7abbd0-762b-41e3-8a26-57ad50d2eea3)