Masquerading Microsoft Word from Downloads

nomit vyas@xoxo

•updated Feb 19, 2026•0•18

Detects execution of renamed instances of Microsoft Word from the Downloads directory, which may indicate masquerading or malicious delivery.