Skip to content
Threat Feed
Subscribe

Product

Microsoft Excel

5 briefs RSS
medium advisory

Suspicious macOS MS Office Child Process

This rule identifies suspicious child processes of Microsoft Office applications on macOS, which often result from exploitation or malicious macros, by detecting unexpected processes like curl, bash, osascript, and python spawned by Office apps, while filtering out false positives related to product version discovery, error reporting, and legitimate software.

Microsoft Word +7 endpoint macos initial_access microsoft_office
2r 6t
high advisory

Excel Spawning Uncommon Microsoft Applications

Microsoft Excel spawning uncommon Microsoft application executables like WINPROJ.EXE, FOXPROW.exe, or SCHDPLUS.exe is anomalous and may indicate malicious activity, such as malware execution, persistence mechanisms, or command-and-control attempts.

Microsoft Excel +3 lateral-movement execution initial-access windows
3r 1t
medium advisory

Suspicious Execution via Microsoft Office Add-Ins

This rule identifies suspicious execution patterns where Microsoft Office applications launch add-ins from unusual paths or with atypical parent processes, potentially indicating initial access via a malicious phishing MS Office Add-In.

Microsoft Word +3 office-addins initial-access phishing
3r 4t
medium advisory

Suspicious MS Office Child Process

Detects suspicious child processes of Microsoft Office applications, indicating potential exploitation or malicious macros for initial access, defense evasion, and execution.

Microsoft Office +4 initial-access defense-evasion execution discovery windows
2r 18t
high threat

Microsoft Excel XLM Macro Remote Code Execution on macOS

A logic flaw in Microsoft Excel allows remote code execution on macOS via malicious XLM macros in SYLK files, bypassing the 'Disable all macros without notification' setting.

exploited Excel +4 xlm rce macro macos sylk
3r