Office Application Child Process Execution of Command Interpreters

Ankit Mehta@Secvyn

•updated Jun 25, 2026•0•0•3

Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.