macOS Office Apps Spawning Shell or Scripting Processes

Alerts when Microsoft Office on macOS launches suspicious shell/script or download utilities as child processes.

FreeReviewedSigma · High · v2

Product: macos
Category: process_creation
Author: Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
Published: 2023-01-31
Updated: 2026-07-31

ATT&CK techniques

Execution → Persistence

Recon
Resource Dev
Initial Access
Execution
- T1059.002AppleScript
- T1204.002Malicious File
Persistence
- T1137.002Office Test
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags macOS process executions where a Microsoft Office application (Word, Excel, PowerPoint, or OneNote) spawns a child process whose executable name ends with common command-line or scripting interpreters/tools (e.g., bash, sh, zsh, python, curl, wget, osascript, osacompile). Such behavior is suspicious because Office-driven execution is often used to run external commands after user interaction, including macro or script activity. The detection relies on process creation telemetry that includes parent process image names and the child process executable path.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Suspicious Shell Execution Referencing Mounted DMG Volume via Terminal (macOS)

Suspicious Microsoft Office Test Persistence Key Creation (via registry_set)

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious NFe-Themed Brazilian Lure Executable Execution

Suspicious Osascript Requesting Administrator Privileges (via process_creation)

Suspicious Executable Dropped in Public Users Directory Named Ctrlpanel (via file_event)

Suspicious Interlock Fake Updater Executable Execution

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

macOS Office Apps Spawning Shell or Scripting Processes

Pivot detection · T1204.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-suspicious-shell-python-child-processes-spawned-by-microsoft-office-apps-69483748

title: macOS Office Apps Spawning Shell or Scripting Processes
id: d75ca91d-084c-480f-b739-dba4eebdc928
status: test
description: This rule flags macOS process executions where a Microsoft Office application (Word, Excel, PowerPoint, or OneNote) spawns a child process whose executable name ends with common command-line or scripting interpreters/tools (e.g., bash, sh, zsh, python, curl, wget, osascript, osacompile). Such behavior is suspicious because Office-driven execution is often used to run external commands after user interaction, including macro or script activity. The detection relies on process creation telemetry that includes parent process image names and the child process executable path.
references:
  - https://redcanary.com/blog/applescript/
  - https://objective-see.org/blog/blog_0x4B.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-01-31
modified: 2023-02-04
tags:
  - attack.execution
  - attack.persistence
  - attack.t1059.002
  - attack.t1137.002
  - attack.t1204.002
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    ParentImage|contains:
      - Microsoft Word
      - Microsoft Excel
      - Microsoft PowerPoint
      - Microsoft OneNote
    Image|endswith:
      - /bash
      - /curl
      - /dash
      - /fish
      - /osacompile
      - /osascript
      - /sh
      - /zsh
      - /python
      - /python3
      - /wget
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 69483748-1525-4a6c-95ca-90dc8d431b68
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL