Suspicious Binary In User Directory Spawned From Office Application

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•1

Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)