Microsoft Office Application Spawning Shell

Shikha Sangwan@ssangwan

•updated Feb 23, 2026•4•0•114

Detects Microsoft Office applications such as Word or Excel spawning a command-line interpreter (cmd.exe or powershell.exe). This behavior is often associated with malicious documents that execute macros to run commands on the victim's system. The MuddyWater group has been observed using this technique in their 'Operation Olalampo' campaign.