huntrule

Suspicious word_update.exe Spawning Command Shell in Remcos Chain (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-31
Updated
2026-10-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a process named word_update.exe spawning cmd.exe, a step in the UAC-0050 RemcosRAT chain where a masqueraded Word updater injects and pivots into a command shell. The loader uses unnamed pipes to hand decrypted payload data to child processes and evade EDR. Detecting this parent-child pair exposes the in-memory Remcos staging behavior.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PowerShell Shellcode Loader via Function Pointer Delegate
Malicious PowerShell Runtime Loaded Outside PowerShell Host
Suspicious AutoIt Interpreter Launched by Script Host or Shell
Windows PowerShell Base64-encoded shellcode in ScriptBlockText
Suspicious PowerShell Spawning mshta for Malware Execution (via process_creation)
Malicious SolarWinds BusinessLayerHost Spawning Suspicious Child Process (SUNBURST) (via process_creation)
Malicious Remote HTA Download and Execution via mshta by UAC-0050 (via process_creation)
Suspicious IIS Worker Process Spawning Command or Scripting Interpreter via SharePoint ToolShell Exploitation (via process_creation)
Suspicious PowerShell Download Cradle Spawned from Explorer via ClickFix Lure (via process_creation)
Suspicious word_update.exe Spawning Command Shell in Remcos Chain (via process_creation)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.