Malicious Office Macro with Suspicious Child Process Chain

Threat Scout@ThreatScout

•updated Aug 8, 2025•10•0•105

Adversaries often use malicious macros embedded in Office documents (Word, Excel) to execute payloads often spawning PowerShell, cmd, or LOLBins. This rule detects macro-triggered process chains indicative of weaponized documents.