Office Macro Abuse: Suspicious Child Process Spawned by Office App

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Access, Publisher) spawning common command interpreters or scripting engines. This behavior is a common indicator of macro-based malware or malicious document exploitation where Office applications are used as an initial access vector to execute arbitrary code.