Office Macro MSIEXEC Execution Proxy

[Daveb3d]

I've seen several Office macros executing through services.exe -> msiexec.exe, so that the Office app does not have a direct child process.  This rule will stop that. MSHTA added because I'm sure it could be similarly utilized.  Other Office apps would be appropriate adds as well.  

Rule {
	Process {
		Include OBJECT_NAME {
			-v "winword.exe"
			-v "powerpnt.exe"
			-v "excel.exe"
			-v "mshta.exe"
		}
	}
	Target {
		Match SECTION {
			Include OBJECT_NAME { 
                -v "msi.dll"
            }
			Include -access "CREATE" 
		}
	}
}

[Sivakumar1]

Hello @Daveb3d .Thank you for reaching out to community and thank you for your suggestion on this Rule. However I would recommend you to submit a SR and we could take it forward from there.