Supported output formats include also vba (can be delivered via office document) and HTA. It supports injecting code into 32 bits binaries only.
When executed, we can see from sysmon event 8 "CreateRemoteThread" the following artifacts:
- 64 bits binary creates a remote thread in a 32 bits program
- StartModule/StartFunction is not mapped to an image
IBM AQL hunting query:
select "SourceImage", "TargetImage", "StartModule", "StartFunction" from events where eventid=8 and (SourceImage IMATCHES '(?i)((.*system32\\(cscript.*|.*wscript.*|.*mshta.*))|(.*winword.*|.*excel.*|.*powerpnt.*))') and (TargetImage imatches '.*syswow64.*')
Tested using default CACTUSTORCH script:
For a period of 1 month, this AQL search matched only the events related to our test [12 occurrences - Not Bad :)]