Suspicious WMIC Execution Via Office Process
This rule detects suspicious execution of WMIC (Windows Management Instrumentation Command-line) by Microsoft Office applications. Adversaries often leverage Office applications as an initial execution vector and then use LOLBINs (Living Off the Land Binaries) like WMIC to proxy execution, break parent-child process chains, and evade detection. Specifically, this rule looks for Office processes (Word, Excel, PowerPoint, etc.) spawning `wmic.exe` with command-line arguments indicative of process creation and execution of other suspicious LOLBINs such as `regsvr32`, `rundll32`, `msiexec`, `mshta`, `verclsid`, `wscript`, or `cscript`.
Sigma
