
title: LittleCorporal Generated Maldoc Injection
author: Christian Burkard
date: 2021/08/09
description: Detects the process injection of a LittleCorporal generated Maldoc.
detection:
  SELECTION_1:
    EventID: 10
  SELECTION_2:
    SourceImage: '*winword.exe'
  SELECTION_3:
    CallTrace: '*:\Windows\Microsoft.NET\Framework64\v2.*'
  SELECTION_4:
    CallTrace: '*UNKNOWN*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- unknown
id: 7bdde3bf-2a42-4c39-aa31-a92b3e17afac
level: high
logsource:
  category: process_access
  product: windows
references:
- https://github.com/connormcgarr/LittleCorporal
status: experimental
tags:
- attack.execution
- attack.t1204.002
- attack.t1055.003
ruletype: SIGMA
