Product
Microsoft Security Updates — July 2026
11 CVEs 354 IOCsRoundup of Microsoft security advisories published in July 2026.
MSBuild Started by Microsoft Office Application
2 rules 2 TTPsThe Microsoft Build Engine (MSBuild) being started by a Microsoft Office application is an unusual behavior that could indicate a malicious document is executing a payload to evade defenses and execute code.
XSL Script Execution via COM Interface in Microsoft Office
2 rules 5 TTPsAdversaries may exploit Microsoft Office applications to execute malicious JScript or VBScript by leveraging the Microsoft.XMLDOM COM interface to process and transform XML documents using XSL scripts, potentially leading to initial access or defense evasion.
Suspicious MS Office Child Process
2 rules 18 TTPs 1 CVEThis rule detects suspicious child processes spawned by Microsoft Office applications, indicating potential exploitation or malicious macros used for initial access, command execution, defense evasion, and discovery activities.
Suspicious Image Load (taskschd.dll) from MS Office
2 rules 2 TTPsDetection of taskschd.dll image loads from Microsoft Office applications indicates potential COM-based scheduled task creation for persistence, bypassing traditional schtasks.exe usage.
Microsoft Office Use-After-Free Vulnerability CVE-2026-32190
2 rules 3 TTPs 1 CVECVE-2026-32190 is a use-after-free vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally.
Suspicious Command Prompt Network Connection
2 rules 4 TTPsThis alert identifies suspicious network connections initiated by the command prompt (cmd.exe) when executed with arguments indicative of script execution, remote resource access, or originating from Microsoft Office applications, which is a common tactic for downloading payloads or establishing command and control.