Skip to content
Threat Feed
Subscribe

Product

Microsoft Word

5 briefs RSS
medium advisory

Suspicious macOS MS Office Child Process

This rule identifies suspicious child processes of Microsoft Office applications on macOS, which often result from exploitation or malicious macros, by detecting unexpected processes like curl, bash, osascript, and python spawned by Office apps, while filtering out false positives related to product version discovery, error reporting, and legitimate software.

Microsoft Word +7 endpoint macos initial_access microsoft_office
2r 6t
medium advisory

Suspicious Execution via Microsoft Office Add-Ins

This rule identifies suspicious execution patterns where Microsoft Office applications launch add-ins from unusual paths or with atypical parent processes, potentially indicating initial access via a malicious phishing MS Office Add-In.

Microsoft Word +3 office-addins initial-access phishing
3r 4t
high advisory

Microsoft Office for Mac Sandbox Escape via Faulty Regex

A vulnerability in Microsoft Office for Mac allows malicious code to escape the application's sandbox and achieve persistence by abusing a faulty regex for temporary files.

Microsoft Word sandbox-escape persistence office-macro macos
2r 3t
medium advisory

Suspicious MS Office Child Process

Detects suspicious child processes of Microsoft Office applications, indicating potential exploitation or malicious macros for initial access, defense evasion, and execution.

Microsoft Office +4 initial-access defense-evasion execution discovery windows
2r 18t
medium advisory

Potential DLL Side-Loading via Trusted Microsoft Programs

This rule detects potential DLL side-loading attempts by identifying trusted Microsoft programs (WinWord.exe, EXPLORER.EXE, w3wp.exe, DISM.EXE) running from non-standard paths or after being renamed to evade defenses.

Microsoft Word +2 defense-evasion execution windows dll side-loading
2r 2t