Remcos RAT delivery via CVE-2017-0199 winword.exe spawning mshta.exe
Detects the execution of child processes (mshta, cmd, powershell, wscript, cscript) spawned by Microsoft Word (winword.exe), which is a common post-exploitation pattern for Remcos RAT delivered via malicious RTF documents utilizing CVE-2017-0199 remote template injection.
YARA-L
