Microsoft Office Spawning Suspicious Child Process

nomit vyas@xoxo

•updated Jan 29, 2026•5•0•50

Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, Publisher, Visio, Access) spawns a suspicious child process. The child processes include commonly abused Windows utilities such as PowerShell, cmd, wscript, cscript, mshta, rundll32, certutil, bitsadmin, and regsvr32. This behavior can indicate malicious code execution originating from an Office document, often associated with phishing or document-based malware.