Suspicious Microsoft Office Child Process on MacOS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•27

Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.