Suspicious Process Spawned from Office Applications
This rule detects the creation of suspicious child processes by Microsoft Office applications. This behavior is commonly associated with malicious macros embedded in Office documents or phishing attacks that leverage Office documents to execute arbitrary commands. The rule specifically looks for Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Publisher, Visio, Access) spawning known suspicious executables like command prompts, PowerShell, script interpreters (wscript, cscript), and various utility tools (mshta, regsvr32, rundll32, certutil, bitsadmin, wmic, schtasks, whoami, net, netsh, nslookup, curl).
Microsoft Sentinel (KQL)
