cmd.exe /c Spawned by Script Host or Office Process (Suspicious Parent)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•9•0•16

This rule detects the execution of cmd.exe with a command line argument (/c) spawned directly from common application entry points such as Microsoft Office (Word, Excel, PowerPoint, Outlook) or scripting engines (wscript.exe, cscript.exe). This pattern is a common indicator of malicious macro-based execution, weaponized document exploitation, or script-based secondary payload execution.