title: Office Application Spawns Scripting or LOLBin Process

id: 67a438b8-b930-4760-ab4e-99810ad450a3

status: experimental

description: >

  Detects a Microsoft Office application spawning a script interpreter or living-off-the-land

  binary, a classic phishing-to-execution pivot (macro or exploit dropping a child process).

references:

  - https://attack.mitre.org/techniques/T1566/

  - https://attack.mitre.org/techniques/T1059/

author: Zion Boggan

date: 2026-05-13

tags:

  - attack.initial_access

  - attack.t1566.001

  - attack.execution

  - attack.t1059.001

logsource:

  product: windows

  category: process_creation

detection:

  selection:

    ParentImage|endswith:

      - '\winword.exe'

      - '\excel.exe'

      - '\powerpnt.exe'

      - '\outlook.exe'

      - '\mspub.exe'

    Image|endswith:

      - '\cmd.exe'

      - '\powershell.exe'

      - '\pwsh.exe'

      - '\wscript.exe'

      - '\cscript.exe'

      - '\mshta.exe'

      - '\rundll32.exe'

      - '\regsvr32.exe'

      - '\bitsadmin.exe'

  condition: selection

falsepositives:

  - Some enterprise document templates legitimately call scripts; rare, baseline per environment.

level: high