GoldenEye XLS with Macro - file Schneider-Bewerbung.xls

Hunt Hypothesis

This hunt targets adversaries leveraging macro-enabled Excel documents disguised as job applications to execute initial payload delivery or credential harvesting within the organization. Proactively hunting for this behavior in Azure Sentinel is critical because low-severity alerts often mask sophisticated social engineering campaigns that rely on user interaction with seemingly benign files like “Schneider-Bewerbung.xls.”

YARA Rule

rule GoldenEye_Ransomware_XLS {
   meta:
      description = "GoldenEye XLS with Macro - file Schneider-Bewerbung.xls"
      author = "Florian Roth"
      reference = "https://goo.gl/jp2SkT"
      date = "2016-12-06"
      hash1 = "2320d4232ee80cc90bacd768ba52374a21d0773c39895b88cdcaa7782e16c441"
   strings:
      $x1 = "fso.GetTempName();tmp_path = tmp_path.replace('.tmp', '.exe')" fullword ascii
      $x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 4000KB and 1 of them )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://goo.gl/jp2SkT
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the GoldenEye XLS with Macro detection rule in an enterprise environment, along with suggested filters:

• HR Department Automated Recruitment Workflow

  • Scenario: The HR team utilizes a scheduled PowerShell script or a dedicated RPA tool (e.g., UiPath) to process incoming job applications. This automation downloads the template Schneider-Bewerbung.xls from a shared network drive, injects candidate data via VBA macros, and saves it back to the server. Since this file is part of a standard hiring package, its macro execution is expected behavior rather than an anomaly.
  • Suggested Filter: Exclude traffic originating from the specific service account used by the RPA tool (e.g., svc-hr-automation) or whitelist the known hash of Schneider-Bewerbung.xls if it remains static across all instances.

• IT Admin Distribution via Group Policy

  • Scenario: During a quarterly security update, IT administrators push a standardized Excel template containing macro-enabled training modules to all workstations using Microsoft Endpoint Configuration Manager (MECM/SCCM). The file Schneider-Bewerbung.xls is deployed as part of this package and executed automatically upon user login to initialize local settings or launch the training interface.
  • Suggested Filter: Create an exclusion for events where the parent process is ccmexec.exe (System Center Configuration Manager) or gpupdate.exe, specifically targeting the file path within the corporate distribution point folder (e.g., C:\Program Files\Company\Templates\).

• Finance Department End-of-Month Reporting Job

  • Scenario: The Finance team runs a nightly scheduled task using Windows Task Scheduler to aggregate monthly data. This job opens Schneider-Bewerbung.xls (which contains complex VBA macros for financial calculations) to generate reports that are