Suspicious New Instance Of An Office COM Object

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•24

Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc. This can be used by malicious actors to create malicious Office documents with macros on the fly.