CVE-2025-60727 Excel RCE - Executable File Written by Excel Process
Detects instances where Microsoft Excel (excel.exe) initiates the creation of potentially executable files (e.g., .exe, .dll, .bat, .ps1, .vbs, .js, .hta). This behavior is often indicative of malicious macros or document-based payloads attempting to drop secondary stages of an attack.
Microsoft Sentinel (KQL)
