Know executable file

[Bouzeghoub]

Hi,

Please, any idea to known executable from Microsoft Office Ex: .docx file with XQL query.

Best regards.

[susekar · Accepted solution]

Hello @Bouzeghoub ,

Greetings for the day!

To identify executables associated with Microsoft Office activity (such as a .docx file being opened in Word) using XQL, you should query the xdr_data dataset. This dataset tracks real-time endpoint activity, including process execution and file operations.

In the context of Microsoft Office, the primary processes responsible for handling files are:

• winword.exe – Word documents (.doc, .docx)

• excel.exe – Excel spreadsheets (.xls, .xlsx)

• powerpnt.exe – PowerPoint presentations (.ppt, .pptx)

---

1. Identifying Child Processes (Executables Spawned by Office)

Attackers often use malicious macros in Office documents to spawn secondary processes. You can use the following query to identify when an Office application (the actor) starts a new process:

dataset = xdr_data | filter actor_process_image_name in ("winword.exe", "excel.exe", "powerpnt.exe") | filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START | fields _time, agent_hostname, actor_process_image_name, action_process_image_name, action_process_image_command_line

---

2. Identifying Executable Files Written to Disk by Office

You can also hunt for cases where an Office application creates an executable file (.exe) on disk, which is a common indicator of a dropped payload:

dataset = xdr_data | filter actor_process_image_name in ("winword.exe", "excel.exe", "powerpnt.exe") | filter event_type = ENUM.FILE and action_file_extension = "exe" | fields _time, agent_hostname, actor_process_image_name, action_file_name, action_file_path, action_file_sha256

---

3. Identifying the Specific Document Trigger

To determine which document (for example, invoice.docx) triggered the activity, inspect the Office process command line or related file-open events:

dataset = xdr_data | filter actor_process_image_name = "winword.exe" | filter actor_process_command_line contains ".docx" | filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START | fields _time, agent_hostname, actor_process_command_line, action_process_image_name, action_process_image_command_line

---

Summary of Data Sources

• Process execution tracking: Use the xdr_data dataset or the xdr_process preset for real-time threat hunting.

• Installed software inventory: If you only need to confirm which systems have Microsoft Office installed, use the host_inventory_applications preset.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New year!!

Thanks & Regards,
S. Subashkar Sekar