Suspicious Speech Runtime Binary Child Process

SigmaHQ Detections@sigmaHQ

•updated Oct 29, 2025•0•13

Detects suspicious child processes spawned by 'SpeechRuntime.exe'. This activity is indicative of potential lateral movement attempts, specifically through COM & DCOM hijacking, where 'SpeechRuntime.exe' is abused as a proxy for execution.