Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp

Alerts when excel.exe spawns foxprow.exe, schdplus.exe, or winproj.exe, consistent with suspicious Excel DCOM automation activity.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Aaron Stratton (SigmaHQ), DRL 1.1
Published: 2023-11-13
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.003Distributed Component Object Model
Collection
C2
Exfiltration
Impact

What it detects

This rule flags suspicious child processes spawned by excel.exe where the child executable name matches foxprow.exe, schdplus.exe, or winproj.exe. Such behavior can indicate lateral movement attempts using an Excel DCOM automation pattern, where Excel is leveraged to execute or relay actions to other components. The detection relies on Windows process creation telemetry, including parent and child process image paths and OriginalFileName metadata.

Reporting behind it

Related detections9 linkedT1021.003 — drag to rearrange

Malicious Impacket DCOMexec Process Abuse via MMC (via process_creation)

Malicious Impacket DCOMexec Privilege Abuse via MMC (via security)

DCOM Lateral Movement - Via MMC20 (via powershell)

Suspicious DLL Payload Dropped Under Non-Standard Assembly Directory (via file_event)

Windows SpeechRuntime.exe Child Process Creation

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

RPC Firewall detects remote DCOM/WMI-related RPC operations via specified interface UUIDs

Windows DCOM InternetExplorer.Application iertutil.dll DLL Hijack Suspicion

Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp

Pivot detection · T1021.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-excel-dcom-child-processes-linked-to-activatemicrosofta-551d9c1f

title: "Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp"
id: 8c8e6f4f-908f-4607-a05b-35fc291237e6
status: test
description: This rule flags suspicious child processes spawned by excel.exe where the child executable name matches foxprow.exe, schdplus.exe, or winproj.exe. Such behavior can indicate lateral movement attempts using an Excel DCOM automation pattern, where Excel is leveraged to execute or relay actions to other components. The detection relies on Windows process creation telemetry, including parent and child process image paths and OriginalFileName metadata.
references:
  - https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922
  - https://github.com/grayhatkiller/SharpExShell
  - https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml
author: Aaron Stratton, Huntrule Team
date: 2023-11-13
tags:
  - attack.t1021.003
  - attack.lateral-movement
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \excel.exe
  selection_child:
    - OriginalFileName:
        - foxprow.exe
        - schdplus.exe
        - winproj.exe
    - Image|endswith:
        - \foxprow.exe
        - \schdplus.exe
        - \winproj.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 551d9c1f-816c-445b-a7a6-7a3864720d60
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL