Suspicious MS Office Child Process
Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from…
Description
Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 9 ATT&CK techniques it maps to.
- Log source category
- event_index
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
- T1218System Binary Proxy Execution251 detections cover this technique
- T1218.001Compiled HTML File13 detections cover this technique
- T1218.002Control Panel5 detections cover this technique
- T1218.003CMSTP21 detections cover this technique
- T1218.004InstallUtil15 detections cover this technique
- T1218.005Mshta49 detections cover this technique
- T1218.008Odbcconf17 detections cover this technique
- T1218.009Regsvcs/Regasm18 detections cover this technique
- T1218.010Regsvr3244 detections cover this technique
- T1218.011Rundll3280 detections cover this technique
- T1016System Network Configuration Discovery45 detections cover this technique
- T1033System Owner/User Discovery63 detections cover this technique
- T1049System Network Connections Discovery22 detections cover this technique
- T1057Process Discovery29 detections cover this technique
- T1082System Information Discovery134 detections cover this technique
References
| Reference | Cited by |
|---|---|
| www.elastic.co/blog/vulnerability-summary-follina | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- a624863f-a70d-417f-a7d2-7a404638d47f
- Tagged by the source as
- Data Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic EndgameData Source: Microsoft Defender XDRData Source: SentinelOneData Source: SysmonData Source: Windows Security Event LogsDomain: EndpointNoise: MediumOS: WindowsPerformance: NormalPlatform: WindowsProfile: RecommendedResources: Investigation GuideRule Type: Event Correlation (EQL)Tactic: Defense EvasionTactic: ExecutionTactic: Initial AccessThreat: Living off the LandUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3