Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
This rule detects suspicious child processes spawned by Excel.exe, which can indicate lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object. Specifically, it looks for child processes with original filenames or image paths ending in 'foxprow.exe', 'schdplus.exe', or 'winproj.exe'. This behavior is associated with DCOM abuse for remote code execution.
Sigma
