Microsoft Office Application Spawning Command Interpreter

nomit vyas@xoxo

•updated Apr 30, 2026•1•0•47

This rule detects when a Microsoft Office application (Word, Excel, PowerPoint) spawns a command interpreter (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute commands on the system.