Suspicious cmd.exe /c spawned from document viewer or browser

Ibrahim Saud@tektrix

•updated Jul 2, 2026•7•0•5

Detects the spawning of cmd.exe from common user-facing applications (e.g., Microsoft Office, web browsers, PDF readers) with command line arguments containing '/c'. This behavior is frequently associated with malicious document execution, drive-by downloads, or other initial access techniques where an attacker attempts to break out of the application sandbox to execute secondary payloads or perform reconnaissance.