Remcos CVE-2017-0199 OLE Exploit - Office Spawning mshta/wscript

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Microsoft Office applications (Word, Excel, PowerPoint) and WordPad spawning command-line interpreters (mshta, wscript, cscript, cmd, powershell, pwsh). This behavior is often associated with macro-based malware or malicious document attachments attempting to execute scripts or shell commands to facilitate further infection stages.