Suspicious Shell Spawning from Microsoft Office Applications

Danny Y@zendannyy

•updated Jun 13, 2026•1•0•9

Detects suspicious child processes (cmd.exe, cscript.exe, powershell.exe) spawned by Microsoft Outlook or Word. This behavior is often indicative of malicious activity, such as phishing attacks delivering malicious documents or emails that execute scripts or commands.