Malware Shellcode Injection in Verclsid from Office/VBA

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects process access to 'verclsid.exe' that involves injecting shellcode, originating from a Microsoft Office application or VBA macro. This behavior is indicative of malicious activity, potentially leveraging 'verclsid.exe' for defense evasion and privilege escalation.