Suspicious Child Process from Microsoft Office Application

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•22

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.). This often indicates an attempt to execute malicious code via Office applications, leveraging common living-off-the-land binaries (LOLBINs) or other suspicious executables.