SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Malware

Macro malware

Office macro code that runs when a document opens

categoryMalwareseverityHighdetectability (measured in our lab)Lowlabpartially detected

Example: Emotet maldocs

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1204.002 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1204.002 -Tool atomic -RunId run-2026-10-14-023 -Command 'Invoke-AtomicTest T1204.002 -TestGuids 24fd9719-7419-42dd-bce6-ab3463110b3c -TimeoutSeconds 120'
ATT&CK T1204.002 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1204.002 -Tool atomic -RunId run-2026-10-18-009 -Command 'Invoke-AtomicTest T1204.002 -TestGuids 24fd9719-7419-42dd-bce6-ab3463110b3c -TimeoutSeconds 120'

What our lab measured

partially detected windows · 2026-10-18 · detected in 61s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell executed "New-ItemProperty -Path". Possible addition of new item to registry
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
PowerShell · EID 4104Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624Non network or service local logon.
… and 4 more event type(s)

Detection that fired

  • ✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~58181 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-14

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
Security · EID 4624Non network or service local logon.
Security · EID 4634Non service account logged off.
Security · EID 4672Special privileges assigned to new logon.

Plus 6 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~498 incidental alerts/hour — tune against this.

Classification

26 values: 2 lab-measured, 9 imported, 2 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vectorMalwareSocial engineering
Reach (CVSS)Local
Attack complexityLow
Privileges requiredNone
User interactionActive
Attacker skill requiredLow
Resources requiredLow
Likelihood / prevalenceHigh
MaturityEstablished

Impact & scope

SeverityHigh
ImpactConfidentialityIntegrity
PlatformLinuxmacOSWindows
EnvironmentOn-premises
Target asset classEndpoint
Kill-chain phase (tactic)Execution
Remote supportNo

Detection & telemetry

Detectability (measured in our lab)Low
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)File CreationFile MetadataProcess Creation

Detection & response

Mitigated by 18

  • M1017 attack-mitigation
  • M1038 attack-mitigation
  • M1040 attack-mitigation
  • D3-CF d3fend
  • D3-CM d3fend
  • D3-CQ d3fend
  • D3-DA d3fend
  • D3-DF d3fend
  • D3-EAL d3fend
  • D3-EDL d3fend
  • D3-EFA d3fend
  • D3-FA d3fend
  • D3-FE d3fend
  • D3-FEV d3fend
  • D3-FIM d3fend
  • D3-LFP d3fend
  • D3-RF d3fend
  • D3-RFAM d3fend

Detected by 40

  • DET0294 attack-detection-strategy
  • 00d0b5ab-1f55-4120-8e83-487c0a7baf19 sigma
  • 1193d960-2369-499f-a158-7b50a31df682 sigma
  • 1337afba-d17d-4d23-bd55-29b927603b30 sigma
  • 208748f7-881d-47ac-a29c-07ea84bf691d sigma
  • 28208707-fe31-437f-9a7f-4b1108b94d2e sigma
  • 289dfa9e-e378-4a56-a9d4-7ed5ee218029 sigma
  • 29fd07fc-9cfd-4331-b7fd-cc18dfa21052 sigma
  • 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e sigma
  • 401e5d00-b944-11ea-8f9a-00163ecd60ae sigma
  • 438025f9-5856-4663-83f7-52f878a70a50 sigma
  • 4922a5dd-6743-4fc2-8e81-144374280997 sigma
  • 557e3bd3-7f21-495d-8d50-7c8bdfb8041c sigma
  • 60936b49-fca0-4f32-993d-7415edcf9a5d sigma
  • 678eb5f4-8597-4be6-8be7-905e4234b53a sigma
  • 69483748-1525-4a6c-95ca-90dc8d431b68 sigma
  • 7bdde3bf-2a42-4c39-aa31-a92b3e17afac sigma
  • 864403a1-36c9-40a2-a982-4c9a45f7d833 sigma
  • 8a582fe2-0882-4b89-a82a-da6b2dc32937 sigma
  • 90217a70-13fc-48e4-b3db-0d836c5824ac sigma
  • 932ac737-33ca-4afd-9869-0d48b391fcc9 sigma
  • 9a025188-6f2d-42f8-bb2f-d3a83d24a5af sigma
  • 9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed sigma
  • 9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b sigma
  • 9cfe4b27-1e56-48b4-b7a8-d46851c91a44 sigma
  • a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c sigma
  • aa3a6f94-890e-4e22-b634-ffdfd54792cc sigma
  • af4c4609-5755-42fe-8075-4effb49f5d44 sigma
  • af5732ed-764e-489d-826d-0447c8b36242 sigma
  • b5de2919-b74a-4805-91a7-5049accbaefe sigma
  • c5f4b5cb-4c25-4249-ba91-aa03626e3185 sigma
  • c7a74c80-ba5a-486e-9974-ab9e682bc5e4 sigma
  • d13c43f0-f66b-4279-8b2c-5912077c1780 sigma
  • dd8756e7-a3a0-4768-b47e-8f545d1a751c sigma
  • e1693bc8-7168-4eab-8718-cdcaa68a1738 sigma
  • e54279c7-4910-4e2c-902c-c56a25b549f6 sigma
  • e6ce8457-68b1-485b-9bdd-3c2b5d679aa9 sigma
  • f40017b3-cb2e-4335-ab5d-3babf679c1de sigma
  • fdd84c68-a1f6-47c9-9477-920584f94905 sigma
  • ff0f2b05-09db-4095-b96d-1b75ca24894a sigma

Tested by 13

  • 02f35d62-9fdc-4a97-b899-a5d9a876d295 atomic
  • 0330a5d2-a45a-4272-a9ee-e364411c4b18 atomic
  • 22386853-f68d-4b50-a362-de235127c443 atomic
  • 24fd9719-7419-42dd-bce6-ab3463110b3c atomic
  • 3f3120f0-7e50-4be2-88ae-54c61230cb9f atomic
  • 3f3af983-118a-4fa1-85d3-ba4daa739d80 atomic
  • 4ea1fc97-8a46-4b4e-ba48-af43d2a98052 atomic
  • 5202ee05-c420-4148-bf5e-fd7f7d24850c atomic
  • 581d7521-9c4b-420e-9695-2aec5241167f atomic
  • 8bebc690-18c7-4549-bc98-210f7019efff atomic
  • 9215ea92-1ded-41b7-9cd6-79f9a78397aa atomic
  • a19ee671-ed98-4e9d-b19c-d1954a51585a atomic
  • add560ef-20d6-4011-a937-2c340f930911 atomic

Attack relationships

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-14-023partially-detectedatomicwindows2026-10-14
run-2026-10-18-009partially-detectedatomicwindows2026-10-18
  • run-2026-10-14-023 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1204.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=13 max_level=15 dwell_s=90
  • run-2026-10-18-009 — Backlog detectability-baseline probe (priority 5, 3 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1204.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1503 max_level=15 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 105 of Cyber-Attack-Taxonomy.md
  • ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1204.002 as the nearest framework entries; ids verified to exist in the cached catalogues.
  • ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 196 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-023 (partially-detected) for T1204.002: no alert matched the expected technique
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-009 (partially-detected) for T1204.002: no alert matched the expected technique