CVE-2025-60727 Excel RCE - Suspicious Child Process Spawned by Excel

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects Microsoft Excel (excel.exe) spawning child processes commonly used in post-exploitation scenarios, such as command shells, scripting interpreters, and living-off-the-land binaries. This behavior is indicative of potential exploitation of vulnerabilities like CVE-2025-60727 to achieve remote code execution.