Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp

Alerts when excel.exe spawns foxprow.exe, schdplus.exe, or winproj.exe, consistent with suspicious Excel DCOM automation activity.

FreeUnreviewedSigmahighv1

windows-process-creation-excel-dcom-child-processes-linked-to-activatemicrosofta-551d9c1f

title: "Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp"
id: 8c8e6f4f-908f-4607-a05b-35fc291237e6
status: test
description: This rule flags suspicious child processes spawned by excel.exe where the child executable name matches foxprow.exe, schdplus.exe, or winproj.exe. Such behavior can indicate lateral movement attempts using an Excel DCOM automation pattern, where Excel is leveraged to execute or relay actions to other components. The detection relies on Windows process creation telemetry, including parent and child process image paths and OriginalFileName metadata.
references:
  - https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922
  - https://github.com/grayhatkiller/SharpExShell
  - https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml
author: Aaron Stratton, Huntrule Team
date: 2023-11-13
tags:
  - attack.t1021.003
  - attack.lateral-movement
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \excel.exe
  selection_child:
    - OriginalFileName:
        - foxprow.exe
        - schdplus.exe
        - winproj.exe
    - Image|endswith:
        - \foxprow.exe
        - \schdplus.exe
        - \winproj.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 551d9c1f-816c-445b-a7a6-7a3864720d60
    type: derived

What it detects

This rule flags suspicious child processes spawned by excel.exe where the child executable name matches foxprow.exe, schdplus.exe, or winproj.exe. Such behavior can indicate lateral movement attempts using an Excel DCOM automation pattern, where Excel is leveraged to execute or relay actions to other components. The detection relies on Windows process creation telemetry, including parent and child process image paths and OriginalFileName metadata.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.