Windows Excel Spawning Anomalous Microsoft Applications

This analytic identifies the execution of specific Microsoft Office applications (WINPROJ.EXE, FOXPROW.exe, SCHDPLUS.exe) as child processes of Microsoft Excel (EXCEL.EXE). This behavior is considered anomalous because Excel typically spawns internal Office-related processes, and the creation of these particular applications as children is uncommon in normal business workflows. Adversaries may abuse this to execute malicious code, establish persistence, or bypass application controls by leveraging trusted Office applications as initial access or execution vectors. Detecting this relationship helps identify suspicious child processes that could indicate malware execution or command-and-control activity. While some legitimate Office features might trigger this in specific environments, its occurrence generally warrants further investigation to rule out compromise.