huntrule

Suspicious OfficeUpdate.exe Masquerading Word Binary From ProgramData (via process_creation)

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-11
Updated
2026-10-11
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects an executable named OfficeUpdate.exe running from ProgramData, a masqueraded copy of WinWord.exe used to side-load a Cobalt Strike loader. Microsoft Office updates do not execute from this location under that name.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Malicious G DATA Avk.exe Masquerading From Public Folder via PlugX (via process_creation)
Malicious Head Mare Run Key Persistence Masquerading as MicrosoftUpdate
Suspicious wermgr Execution Outside System Directories via process_creation
Suspicious Python Execution of Fake Sysmon Script From Config Directory
Suspicious vcpktsvr Loader Execution From LOCALAPPDATA vcpacket Directory
Suspicious Process Execution From Fake Microsoft Edge ExtSvc Directory
Suspicious kswapd0 Masquerading Miner Process
Suspicious msinfo32.exe Executed From ViPNet Update Directory
Malicious Desktop Window Manager Impersonation From Non-System Path via process_creation
Suspicious OfficeUpdate.exe Masquerading Word Binary From ProgramData (via process_creation)
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.