Document Extension Spawning Command Shell

Jorden Smith@Jorden

•updated Jan 8, 2026•0•31

Detects processes with document file extensions spawning command shells (cmd.exe or powershell.exe), indicating malware execution