CmdID / Files

ONENOTE.EXE

Microsoft OneNote file version info

Program on Windows 1 known copy with hashes 16 Sigma rules name it

Is it the real ONENOTE.EXE?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\

Signed byMicrosoft Corporation

ProductMicrosoft OneNote, Microsoft Corporation

DescriptionMicrosoft OneNote

1 known copy

16.0.12527.20482 · C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE · signed by Microsoft Corporation

2f63db466304af3fd6cb25c02f9dc1abf5d6df44681cb83a8b8b1f124b5211bd

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ONENOTE.EXE

highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)

highOneNote.EXE Execution of Malicious Embedded Scripts@kostastsale

highRenamed Office Binary ExecutionNasreddine Bencherchali (Nextron Systems)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious WMIC Execution Via Office ProcessVadim Khrykov, Cyb3rEng

Sigma names ONENOTE.EXE in 16 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.