Suspicious Microsoft Office Child Process

SigmaHQ Detections@sigmaHQ

•updated Aug 3, 2026•6•0•10

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)