UAC-0057 Malicious Office Document Process Execution

Tim Peck@timpeck

•updated Aug 21, 2025•3•3•33

Detects a Microsoft Office application spawning suspicious child processes to execute dropped files. This behavior is consistent with UAC-0057's use of weaponized XLS documents with VBA macros for initial access.