Office App Spawning Script Interpreter - Macro Execution

Ankit Mehta@Secvyn

•updated Jun 29, 2026•18•0•4

Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.