Windows Office Product Spawned MSDT

The analytic detects a Microsoft Office product spawning the Windows msdt.exe process. This activity is significant as it may indicate an attempt to exploit protocol handlers to bypass security controls, even if macros are disabled. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.