Sunturai
Back to results
HighSigmaHQNasreddine Bencherchali (Nextron Systems)

Suspicious File Created Via OneNote Application

Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild

Detection logic

Detection requirements

Log source product
windows
Log source category
file_event

Known benign triggers

  • False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote.
  • Occasional FPs might occur if OneNote is used internally to share different embedded documents

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice