Office/PDF Reader Spawning Suspicious Child Processes (T1566.001)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.