Skip to content

Commit 1a85b44

Browse files
RavenTaitRavenTait
committed
NotDoor Outlook Macro Detections
1 parent e10b2d8 commit 1a85b44

5 files changed

+338
-0
lines changed

‎detections/endpoint/windows_outlook_dialogs_disabled_from_unusual_process.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Windows Outlook Dialogs Disabled from Unusual Process
2+
id: 94e3ba29-6245-4f25-8d47-d5b6b34c40ac
3+
version: 1
4+
date: '2025-09-08'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the modification of the Windows Registry
9+
key "PONT_STRING" under Outlook Options. This disables certain dialog popups,
10+
which could allow malicious scripts to run without notice. This detection leverages data from
11+
the Endpoint.Registry datamodel to search for this key changing from an unusual process.
12+
This activity is significant as it is commonly associated with some malware
13+
infections, indicating potential malicious intent to harvest email information.
14+
data_source:
15+
- Sysmon EventID 13
16+
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
17+
WHERE Registry.registry_path="*\\Outlook\\Options\\General*" Registry.registry_value_name="PONT_STRING"
18+
by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive
19+
Registry.registry_path Registry.registry_key_name Registry.registry_value_data
20+
Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user
21+
Registry.vendor_product | `drop_dm_object_name(Registry)`| join process_guid [| tstats
22+
`security_content_summariesonly` count FROM datamodel=Endpoint.Processes WHERE NOT
23+
(Processes.process_name = "Outlook.exe") by _time span=1h
24+
Processes.action Processes.dest Processes.original_file_name
25+
Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
26+
Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
27+
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash
28+
Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path
29+
Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)`]
30+
| fields _time parent_process_name parent_process process_name process_path process
31+
process_guid registry_path registry_value_name registry_value_data registry_key_name
32+
action dest user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
33+
| `windows_outlook_dialogs_disabled_from_unusual_process_filter`'
34+
how_to_implement: To successfully implement this search, you need to be ingesting
35+
logs with the registry value name, registry path, and registry value data from your
36+
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
37+
Sysmon TA. https://splunkbase.splunk.com/app/5709
38+
known_false_positives: It is unusual for processes other than Outlook to modify this
39+
feature on a Windows system since it is a default Outlook functionality. Although no
40+
false positives have been identified, use the provided filter macro to tune the search.
41+
references:
42+
- https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
43+
- https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
44+
drilldown_searches:
45+
- name: View the detection results for - "$dest$"
46+
search: '%original_detection_search% | search dest = "$dest$"'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
- name: View risk events for the last 7 days for - "$dest$"
50+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
51+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
52+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
53+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
54+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
55+
| `security_content_ctime(lastTime)`'
56+
earliest_offset: $info_min_time$
57+
latest_offset: $info_max_time$
58+
rba:
59+
message: Outlook Dialog registry key modified on $dest$ by unusual process
60+
risk_objects:
61+
- field: dest
62+
type: system
63+
score: 44
64+
threat_objects: []
65+
tags:
66+
analytic_story:
67+
- NotDoor Malware
68+
- Windows Registry Abuse
69+
asset_type: Endpoint
70+
mitre_attack_id:
71+
- T1112
72+
- T1562
73+
product:
74+
- Splunk Enterprise
75+
- Splunk Enterprise Security
76+
- Splunk Cloud
77+
security_domain: endpoint
78+
tests:
79+
- name: True Positive Test
80+
attack_data:
81+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/notdoor/disable_dialogs/windows-sysmon.log
82+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
83+
sourcetype: XmlWinEventLog
84+

‎detections/endpoint/windows_outlook_loadmacroprovideronboot_persistence.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Windows Outlook LoadMacroProviderOnBoot Persistence
2+
id: 93c91139-01f8-4905-802b-0d106f026b13
3+
version: 1
4+
date: '2025-09-09'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the modification of the Windows Registry
9+
key "LoadMacroProviderOnBoot" under Outlook. This enables automatic loading of macros,
10+
which could allow malicious scripts to run without notice. This detection leverages data from
11+
the Endpoint.Registry datamodel to search for this key being enabled.
12+
This activity is significant as it is commonly associated with some malware
13+
infections, indicating potential malicious intent to harvest email information.
14+
data_source:
15+
- Sysmon EventID 13
16+
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
17+
WHERE Registry.registry_path="*\\Outlook\\*" Registry.registry_value_name="LoadMacroProviderOnBoot"
18+
Registry.registry_value_data="0x00000001" by Registry.action
19+
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
20+
Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
21+
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
22+
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
23+
| `windows_outlook_loadmacroprovideronboot_persistence_filter`'
24+
how_to_implement: To successfully implement this search, you need to be ingesting
25+
logs with the registry value name, registry path, and registry value data from your
26+
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
27+
Sysmon TA. https://splunkbase.splunk.com/app/5709
28+
known_false_positives: It is unusual to modify this feature on a Windows system.
29+
Although no false positives have been identified, use the provided filter macro
30+
to tune the search.
31+
references:
32+
- https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
33+
- https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
34+
drilldown_searches:
35+
- name: View the detection results for - "$dest$"
36+
search: '%original_detection_search% | search dest = "$dest$"'
37+
earliest_offset: $info_min_time$
38+
latest_offset: $info_max_time$
39+
- name: View risk events for the last 7 days for - "$dest$"
40+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
41+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
42+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
43+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
44+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
45+
| `security_content_ctime(lastTime)`'
46+
earliest_offset: $info_min_time$
47+
latest_offset: $info_max_time$
48+
rba:
49+
message: Outlook LoadMacroProviderOnBoot registry key modified on $dest$
50+
risk_objects:
51+
- field: dest
52+
type: system
53+
score: 54
54+
threat_objects: []
55+
tags:
56+
analytic_story:
57+
- NotDoor Malware
58+
- Windows Registry Abuse
59+
asset_type: Endpoint
60+
mitre_attack_id:
61+
- T1112
62+
- T1137
63+
product:
64+
- Splunk Enterprise
65+
- Splunk Enterprise Security
66+
- Splunk Cloud
67+
security_domain: endpoint
68+
tests:
69+
- name: True Positive Test
70+
attack_data:
71+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/notdoor/loadmacroprovideronboot/windows-sysmon.log
72+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
73+
sourcetype: XmlWinEventLog
74+

‎detections/endpoint/windows_outlook_macro_created_by_suspicious_process.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Windows Outlook Macro Created by Suspicious Process
2+
id: 3ec347e3-a94a-4a8b-a918-8306ea403182
3+
version: 1
4+
date: '2025-09-09'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the creation of an Outlook Macro
9+
(VbaProject.OTM) by a suspicious process. This file is normally created when you
10+
create a macro from within Outlook. If this file is created by a process other than
11+
Outlook.exe it may be maliciously created. This detection leverages data from
12+
the Filesystem datamodel, specifically looking for the file creation event for
13+
VbaProject.OTM. This activity is significant as it is commonly associated with
14+
some malware infections, indicating potential malicious intent to harvest email information.
15+
data_source:
16+
- Sysmon EventID 11
17+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
18+
as lastTime values(Filesystem.file_create_time) as file_create_time from datamodel=Endpoint.Filesystem
19+
where Filesystem.file_path="*Appdata\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM"
20+
by Filesystem.action Filesystem.dest Filesystem.file_access_time
21+
Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name
22+
Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid
23+
Filesystem.process_id Filesystem.user Filesystem.vendor_product | `drop_dm_object_name(Filesystem)`
24+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
25+
| `windows_outlook_macro_created_by_suspicious_process_filter`'
26+
how_to_implement: You must be ingesting data that records file-system activity from
27+
your hosts to populate the Endpoint file-system data-model node. If you are using
28+
Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you
29+
want to collect data.
30+
known_false_positives: Because this file are always created by Outlook in normal operations,
31+
you should investigate all results.
32+
references:
33+
- https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
34+
- https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
35+
drilldown_searches:
36+
- name: View the detection results for - "$user$" and "$dest$"
37+
search: '%original_detection_search% | search user = "$user$" dest = "$dest$"'
38+
earliest_offset: $info_min_time$
39+
latest_offset: $info_max_time$
40+
- name: View risk events for the last 7 days for - "$user$" and "$dest$"
41+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$",
42+
"$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time)
43+
as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
44+
Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
45+
as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
46+
by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
47+
earliest_offset: $info_min_time$
48+
latest_offset: $info_max_time$
49+
rba:
50+
message: Suspicious Outlook macro $file_name$ created on $dest$
51+
risk_objects:
52+
- field: user
53+
type: user
54+
score: 70
55+
- field: dest
56+
type: system
57+
score: 70
58+
threat_objects:
59+
- field: file_name
60+
type: file_name
61+
tags:
62+
analytic_story:
63+
- NotDoor Malware
64+
asset_type: Endpoint
65+
mitre_attack_id:
66+
- T1137
67+
- T1059.005
68+
product:
69+
- Splunk Enterprise
70+
- Splunk Enterprise Security
71+
- Splunk Cloud
72+
security_domain: endpoint
73+
tests:
74+
- name: True Positive Test
75+
attack_data:
76+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/notdoor/outlook_macro/windows-sysmon.log
77+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
78+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_outlook_macro_security_modified.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Windows Outlook Macro Security Modified
2+
id: 47872bb4-9987-4c33-a897-4d2d1ac7d4c2
3+
version: 1
4+
date: '2025-09-08'
5+
author: Raven Tait, Splunk
6+
status: production
7+
type: TTP
8+
description: The following analytic detects the modification of the Windows Registry
9+
key "Level" under Outlook Security. This allows macros to execute without warning,
10+
which could allow malicious scripts to run without notice. This detection leverages data from
11+
the Endpoint.Registry datamodel, specifically looking for the registry value name
12+
"Level" with a value of "0x00000001". This activity is significant
13+
as it is commonly associated with some malware infections, indicating potential
14+
malicious intent to harvest email information.
15+
data_source:
16+
- Sysmon EventID 13
17+
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
18+
WHERE Registry.registry_path="*\\Outlook\\Security*" Registry.registry_value_name="Level"
19+
Registry.registry_value_data="0x00000001" by Registry.action
20+
Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path
21+
Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name
22+
Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
23+
| `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
24+
| `windows_outlook_macro_security_modified_filter`'
25+
how_to_implement: To successfully implement this search, you need to be ingesting
26+
logs with the registry value name, registry path, and registry value data from your
27+
endpoints. If you are using Sysmon, you must have at least version 2.0 of the official
28+
Sysmon TA. https://splunkbase.splunk.com/app/5709
29+
known_false_positives: It is unusual to modify this feature on a Windows system since
30+
it is a default security control, although it is not rare for some policies to disable
31+
it. Although no false positives have been identified, use the provided filter macro
32+
to tune the search.
33+
references:
34+
- https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
35+
- https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
36+
drilldown_searches:
37+
- name: View the detection results for - "$dest$"
38+
search: '%original_detection_search% | search dest = "$dest$"'
39+
earliest_offset: $info_min_time$
40+
latest_offset: $info_max_time$
41+
- name: View risk events for the last 7 days for - "$dest$"
42+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
43+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
44+
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
45+
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
46+
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
47+
| `security_content_ctime(lastTime)`'
48+
earliest_offset: $info_min_time$
49+
latest_offset: $info_max_time$
50+
rba:
51+
message: Outlook Macro Security Level registry modified on $dest$
52+
risk_objects:
53+
- field: dest
54+
type: system
55+
score: 44
56+
threat_objects: []
57+
tags:
58+
analytic_story:
59+
- NotDoor Malware
60+
- Windows Registry Abuse
61+
asset_type: Endpoint
62+
mitre_attack_id:
63+
- T1137
64+
- T1008
65+
product:
66+
- Splunk Enterprise
67+
- Splunk Enterprise Security
68+
- Splunk Cloud
69+
security_domain: endpoint
70+
tests:
71+
- name: True Positive Test
72+
attack_data:
73+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/notdoor/macro_security_level/windows-sysmon.log
74+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
75+
sourcetype: XmlWinEventLog

‎stories/notdoor_malware.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: NotDoor Malware
2+
id: 9f01c0ab-f057-477f-980b-ffb72beb10ab
3+
version: 1
4+
status: production
5+
date: '2025-09-09'
6+
author: Raven Tait, Splunk
7+
description: NotDoor is an Outlook backdoor associated with APT28 who is known for breaching
8+
organizations across multiple sectors in NATO member states. This analytical story harnesses
9+
targeted search methodologies to uncover and investigate activities that could be indicative
10+
of NotDoor's presence. These activities include tracking file write operations for dropped macros,
11+
scrutinizing registry modifications aimed at establishing persistence mechanisms,
12+
monitoring suspicious processes, and other malicious actions.
13+
narrative: APT28, also known as Fancy Bear, blends stealth and expertise in its cyber operations. Affiliated with Russia's GRU,
14+
their latest campaign involved the malware, named NotDoor for its use of the term “Nothing” in its code, which is implemented
15+
as a VBA macro for Outlook. It monitors incoming emails for a predefined trigger word, and upon detection, allows attackers
16+
to exfiltrate data, upload files, and execute commands on the compromised system.
17+
references:
18+
- https://lab52.io/blog/analyzing-notdoor-inside-apt28s-expanding-arsenal/
19+
- https://hackread.com/russian-apt28-notdoor-backdoor-microsoft-outlook/
20+
tags:
21+
category:
22+
- Adversary Tactics
23+
product:
24+
- Splunk Enterprise
25+
- Splunk Enterprise Security
26+
- Splunk Cloud
27+
usecase: Advanced Threat Detection

0 commit comments

Comments
 (0)