Lazarus job-offer themed lure leading to Office child process execution
Detects the execution of child processes from common Microsoft Office applications (Word, Excel, Outlook) where the command line contains keywords associated with 'job offer' themes. This pattern is consistent with known spearphishing lures used by the Lazarus Group to initiate infection chains.
Sigma
