CMD Executing Document Extension as PE Binary

Jorden Smith@Jorden

•updated Jan 8, 2026•0•26

Detects cmd.exe spawning processes with document file extensions, indicating a PE binary masquerading as a document