Windows svchost Spawning Office Applications via COM Instance Creation

Flags svchost.exe creating new Office app processes (Word/Excel/PowerPoint/etc.), consistent with Office COM automation.

FreeUnreviewedSigmamediumv1

windows-svchost-spawning-office-applications-via-com-instance-creation-9bdaf1e9

title: Windows svchost Spawning Office Applications via COM Instance Creation
id: 4e719e5a-bcb0-43ab-8409-513decb6d158
status: test
description: This rule identifies a Windows svchost.exe process spawning a new instance of common Microsoft Office executables, indicating Office COM automation being launched. Attackers can leverage COM automation to programmatically generate or prepare Office content, including macro-enabled documents, without direct user interaction. Telemetry relies on process creation events that include parent and child process image paths.
references:
  - https://learn.microsoft.com/en-us/previous-versions/office/troubleshoot/office-developer/automate-word-create-file-using-visual-basic
  - https://github.com/med0x2e/vba2clr
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_office_svchost_parent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-13
modified: 2023-12-19
tags:
  - attack.execution
  - detection.threat-hunting
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \svchost.exe
    Image|endswith:
      - \eqnedt32.exe
      - \excel.exe
      - \msaccess.exe
      - \mspub.exe
      - \powerpnt.exe
      - \visio.exe
      - \winword.exe
  condition: selection
falsepositives:
  - Legitimate usage of office automation via scripting
level: medium
license: DRL-1.1
related:
  - id: 9bdaf1e9-fdef-443b-8081-4341b74a7e28
    type: derived

What it detects

This rule identifies a Windows svchost.exe process spawning a new instance of common Microsoft Office executables, indicating Office COM automation being launched. Attackers can leverage COM automation to programmatically generate or prepare Office content, including macro-enabled documents, without direct user interaction. Telemetry relies on process creation events that include parent and child process image paths.

Known false positives

Legitimate usage of office automation via scripting

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.