Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Flags Word (WINWORD.EXE) spawning csc.exe, a suspicious execution pattern observed in some exploit chains.

FreeReviewedSigma · Critical · v5

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-09-15
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
- T1203Exploitation for Client Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where WINWORD.EXE spawns a child process running as csc.exe. The csc.exe execution from Word is a behavior commonly seen in real-world exploit chains and may indicate malicious code execution rather than normal office activity. Telemetry required is Windows process creation, including parent and child process image paths.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Malicious Office Application Spawning Script Interpreter

Suspicious Chrome Browser Process Spawned by Outlook Indicating Sandbox Escape

Suspicious Office Application Spawning Script Interpreter

Malicious WPS Office ksoqing Protocol Handler Exploitation via Process Creation

Malicious Equation Editor Child Process Indicating Exploit

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious DLL Written to Explorer IconCache Path

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Pivot detection · T1204.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-winword-spawning-csc-exe-sub-process-fdd84c68

title: "Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation"
id: d2206a9b-7d9a-4ccf-8b4f-1b137d11d2e6
status: test
description: This rule flags process creation events where WINWORD.EXE spawns a child process running as csc.exe. The csc.exe execution from Word is a behavior commonly seen in real-world exploit chains and may indicate malicious code execution rather than normal office activity. Telemetry required is Windows process creation, including parent and child process image paths.
references:
  - https://www.hybrid-analysis.com/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  - https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/Exploits/CVE-2017-8759/proc_creation_win_exploit_cve_2017_8759.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-09-15
modified: 2021-11-27
tags:
  - attack.execution
  - attack.t1203
  - attack.t1204.002
  - attack.initial-access
  - attack.t1566.001
  - cve.2017-8759
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WINWORD.EXE
    Image|endswith: \csc.exe
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: fdd84c68-a1f6-47c9-9477-920584f94905
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL