Lion Cipher Lab
Detect Office apps spawning suspicious child processes from Sysmon Event ID 1
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
A huge share of intrusions still begin the same way: someone opens an attachment, and the Office app that opened it starts a program it has no business starting. Word does not normally need a command prompt, and Excel does not normally need mshta.exe. That one relationship, an Office parent with a script-host child, is among the highest-value signals a SOC can watch, and MITRE ATT&CK lists it under User Execution: Malicious File (T1204.002). But the obvious rule ('alert on anything Office starts') fires on every print job and every link someone clicks in an email, while the clever attacker…
What you'll learn
- Reading Sysmon Event ID 1 (process creation) records: Image, ParentImage, CommandLine, ProcessGuid, ParentProcessGuid
- Writing a parent-child detection for Office apps launching script hosts and LOLBins (ATT&CK T1204.002 after T1566.001)
- Walking a process tree upward with ParentProcessGuid to catch grandchildren that a one-hop rule misses
- Tuning with a reviewed exact-command-line allowlist instead of a wildcard that blinds the rule
- Measuring precision and recall per rule against a labelled dataset and reading the misses
- Explaining why WMI-launched processes re-parent to WmiPrvSE.exe, and which Attack Surface Reduction rules cover each path
Steps in this lab
- The attack shape you are watching for
- The event that carries it: Sysmon Event ID 1
- Build the synthetic process-creation stream
- Why the obvious rule drowns you (the judgement)
- Write four rules and score them
- Read the progression like an analyst
- The honest gap: WMI breaks the family tree
- The prevention this detection sits beside: ASR rules
- Optional: look at your own machine (read-only, plus one audit-mode rule)
- Where this goes next