Suspicious Microsoft Office Child Process Activity

Microsoft Office suite applications (Word, Excel, PowerPoint, etc.) are common vectors for initial access and execution. Attackers exploit these applications via malicious documents containing macros, DDE, or embedded vulnerabilities (such as Follina, CVE-2022-30190) to force the host application to spawn child processes. These spawned processes are frequently used to execute secondary stages of an attack, such as downloading further malware, establishing persistence, or executing administrative commands. Because legitimate Office activity rarely involves launching system binaries like PowerShell, cmd, or rundll32, monitoring these parent-child relationships is a critical control for detection engineering teams. Defenders should focus on identifying atypical process lineage where Office applications act as the parent for system tools or binaries located in suspicious writeable directories.

Attack Chain

1. Victim opens a weaponized Microsoft Office document via email or download.
2. The document executes embedded malicious code (Macro, OLE object, or exploit).
3. The Office application invokes a system utility (e.g., cmd.exe or powershell.exe) to bypass security controls.
4. The spawned child process executes encoded scripts or downloads external payloads.
5. The attacker gains initial execution and proceeds to execute secondary modules.
6. Persistence mechanisms are established via scheduled tasks or registry modifications.
7. Final objective (e.g., ransomware deployment or credential theft) is achieved.

Impact

Successful exploitation of this vector allows adversaries to gain initial access, execute code under the context of the user, move laterally, and deploy ransomware or information-stealing malware within an enterprise environment.

Recommendation

• Deploy the provided Sigma rule to alert on suspicious process spawning from Microsoft Office applications.
• Monitor for process creation events (Event ID 1) where the ParentImage matches the Microsoft Office suite.
• Investigate instances where Office processes spawn tools like PowerShell, CMD, WScript, or MSHTA, particularly if they are originating from non-standard paths like \AppData\ or \Windows\Temp.