Windows Office Product Spawned Child Process For Download

This analytic identifies Office applications spawning child processes that attempt to download content via HTTP/HTTPS. It focuses on process creation events where Office applications (e.g., Word, Excel) initiate network connections, specifically excluding common web browsers. This activity is significant because it often indicates the use of malicious documents to execute living-off-the-land binaries (LOLBins) for payload delivery. If confirmed malicious, this behavior could lead to unauthorized code execution, data exfiltration, or further malware deployment, posing a severe threat to the organization's security.