Microsoft Office Spawning Suspicious Child Process

Mehulkumar Savajani@Msavajani

•updated Jan 28, 2026•43•2•364

Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) spawning suspicious child processes like command shells or script interpreters. This behavior can be indicative of malicious macro execution or exploitation of vulnerabilities, where an embedded OLE object leads to code execution.