Suspicious PowerPoint Macro Execution

Ethan Andrews@eandrews

•updated Feb 27, 2026•4•0•30

Detects Microsoft PowerPoint spawning a command-line interpreter (cmd.exe or powershell.exe) to perform suspicious file operations. This behavior was observed in an APT36 campaign where a malicious PowerPoint Add-in (.ppam) was used to create staging directories and extract embedded payloads.