CVE-2015-2470

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where ProcessCommandLine contains "doc" or ProcessCommandLine contains "xls" or ProcessCommandLine contains "ppt"
| where InitiatingProcessFileName !in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe") // Look for Office apps being launched by non-Office processes
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

(sourcetype=WinEventLog:Security EventCode=4688 New_Process_Name IN ("*winword.exe", "*excel.exe", "*powerpnt.exe", "*outlook.exe")) OR (sourcetype=Sysmon EventCode=1 Image IN ("*winword.exe", "*excel.exe", "*powerpnt.exe", "*outlook.exe"))
| where CommandLine LIKE "%doc%" OR CommandLine LIKE "%xls%" OR CommandLine LIKE "%ppt%"
| where NOT ParentImage IN ("*winword.exe", "*excel.exe", "*powerpnt.exe", "*outlook.exe")
| table _time, host, ParentImage, Image, CommandLine, Hashes

Sigma

title: Microsoft Office Integer Underflow Vulnerability
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2015-2470 via crafted Office documents.
references:
  - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081
  - https://www.exploit-db.com/exploits/37924/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  filter_parent_office:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  condition: selection and not filter_parent_office
fields:
  - Image
  - CommandLine
  - ParentImage
tags:
  - attack.execution
  - attack.t1204.002

Elastic ES|QL

from process where process.executable in ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe") and process.command_line : ("*doc*", "*xls*", "*ppt*") and not process.parent.executable in ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe") | select @timestamp, host.name, process.parent.executable, process.executable, process.command_line, process.hash.sha256