TA4922 Phishing: Office App Spawning Suspicious Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•5

Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.