Process Spawning from Office Document Anomaly
This rule detects suspicious process creation events where common scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, regsvcs.exe) are spawned by Microsoft Office applications (winword.exe, excel.exe, powerpnt.exe, outlook.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute payloads.
Microsoft Sentinel (KQL)
