Product
Microsoft October 2026 Security Updates
3 TTPs 3 CVEsMicrosoft addressed 1,413 vulnerabilities including 75 critical flaws and an exploited zero-day (CVE-2026-96951) bypass in Windows Shell that circumvents Mark of the Web protections.
XSL Script Execution via COM Interface in Microsoft Office
2 rules 5 TTPsAdversaries may exploit Microsoft Office applications to execute malicious JScript or VBScript by leveraging the Microsoft.XMLDOM COM interface to process and transform XML documents using XSL scripts, potentially leading to initial access or defense evasion.
Suspicious MS Office Child Process
2 rules 18 TTPs 1 CVEThis rule detects suspicious child processes spawned by Microsoft Office applications, indicating potential exploitation or malicious macros used for initial access, command execution, defense evasion, and discovery activities.
Suspicious Image Load (taskschd.dll) from MS Office
2 rules 2 TTPsDetection of taskschd.dll image loads from Microsoft Office applications indicates potential COM-based scheduled task creation for persistence, bypassing traditional schtasks.exe usage.
Microsoft Office Use-After-Free Vulnerability CVE-2026-32190
2 rules 3 TTPs 1 CVECVE-2026-32190 is a use-after-free vulnerability in Microsoft Office that allows an unauthorized attacker to execute code locally.
Suspicious Command Prompt Network Connection
2 rules 4 TTPsThis alert identifies suspicious network connections initiated by the command prompt (cmd.exe) when executed with arguments indicative of script execution, remote resource access, or originating from Microsoft Office applications, which is a common tactic for downloading payloads or establishing command and control.