WINWORD spawning cmd.exe to run a dropped batch script (HOOKEDGE delivery)
Detects Microsoft Word (winword.exe) spawning the Windows command shell (cmd.exe) to execute batch scripts (.bat or .cmd files). This behavior is commonly associated with malicious document macros attempting to drop and execute secondary payloads, excluding common system paths to reduce false positives.
Microsoft Sentinel (KQL)
