AI-Assisted Initial Access Payload Execution via Office Application

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•3

This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.