LokiBot CVE-2017-0199: Office/RTF Spawning mshta.exe or EQNEDT32.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects when Microsoft Office applications (Word, Excel, Equation Editor, PowerPoint) spawn common LOLBAS processes such as mshta, wscript, cscript, powershell, or cmd. It includes additional filtering for command-line arguments containing indicators of HTA or RTF exploitation patterns, which are typical of malicious Office documents attempting to execute secondary payloads.