huntrule

Suspicious Office Application Spawning Script Or Shell Interpreter

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-10
Updated
2026-09-10
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a Microsoft Office application spawning a command shell or scripting interpreter. MacroPack-generated maldocs used VBA to launch child interpreters that injected and executed offensive-tool loaders such as Havoc and Brute Ratel. Office applications spawning cmd powershell wscript or rundll32 is a strong macro-abuse signal for the initial execution stage of an intrusion.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange
Suspicious VBScript Launcher Execution via Wscript for Mining Operation (via process_creation)
Suspicious Network Connection From wabmig.exe (Turian Injection)
Suspicious Outbound Network Connection from Explorer Process
Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)
Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)
Suspicious BugSleep Marker File in Public Directory
Suspicious MSHTA VBScript WScript Shell Execution
Suspicious CRAT Injection Named Pipe ChromeUpdatePipe (via pipe_created)
Malicious Kimsuky VBE Payload Download via Curl to AppData and Execution (via process_creation)
Suspicious Office Application Spawning Script Or Shell Interpreter
Pivot detection · T1055 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.