Suspicious Child Process Spawning from Productivity Applications

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

Detects the spawning of suspicious child processes such as PowerShell, cmd, or rundll32 from common productivity applications like Microsoft Office or PDF readers. This pattern is often indicative of macro-based execution, malicious document payloads, or living-off-the-land techniques used to initiate secondary stages of an attack.