Excel CVE-2025-60727 Outbound C2 Callback Within 60s of Process Start

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects instances where Microsoft Excel (excel.exe) initiates an external network connection within 60 seconds of process startup. This behavior is often associated with the execution of malicious macros or embedded objects designed to reach out to attacker-controlled infrastructure for downloading secondary payloads or establishing command-and-control (C2) communication.