Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp
Alerts when excel.exe spawns foxprow.exe, schdplus.exe, or winproj.exe, consistent with suspicious Excel DCOM automation activity.
- Product
- windows
- Category
- process_creation
- Author
- Aaron Stratton (SigmaHQ), DRL 1.1
- Published
- 2023-11-13
- Updated
- 2026-07-30
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags suspicious child processes spawned by excel.exe where the child executable name matches foxprow.exe, schdplus.exe, or winproj.exe. Such behavior can indicate lateral movement attempts using an Excel DCOM automation pattern, where Excel is leveraged to execute or relay actions to other components. The detection relies on Windows process creation telemetry, including parent and child process image paths and OriginalFileName metadata.
Reporting behind it
- posts.specterops.iohttps://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922
- github.comhttps://github.com/grayhatkiller/SharpExShell
- learn.microsoft.comhttps://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Excel DCOM Child Processes Linked to ActivateMicrosoftApp"
id: 8c8e6f4f-908f-4607-a05b-35fc291237e6
status: test
description: This rule flags suspicious child processes spawned by excel.exe where the child executable name matches foxprow.exe, schdplus.exe, or winproj.exe. Such behavior can indicate lateral movement attempts using an Excel DCOM automation pattern, where Excel is leveraged to execute or relay actions to other components. The detection relies on Windows process creation telemetry, including parent and child process image paths and OriginalFileName metadata.
references:
- https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922
- https://github.com/grayhatkiller/SharpExShell
- https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml
author: Aaron Stratton, Huntrule Team
date: 2023-11-13
tags:
- attack.t1021.003
- attack.lateral-movement
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \excel.exe
selection_child:
- OriginalFileName:
- foxprow.exe
- schdplus.exe
- winproj.exe
- Image|endswith:
- \foxprow.exe
- \schdplus.exe
- \winproj.exe
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 551d9c1f-816c-445b-a7a6-7a3864720d60
type: derived