Acrobat Spawning Unusual Child Process - FlowerStorm PDF Exploit Behavior

Ankit Mehta@Secvyn

•updated Sep 7, 2026•0•0•1

Detects instances where Adobe Acrobat or Adobe Reader processes initiate suspicious child processes, such as common interpreters (PowerShell, CMD, WScript, CScript) or binaries (rundll32, browser executables) often used in malicious document-based attacks to achieve initial code execution.