Windows svchost.exe Spawning Office Applications via COM Object Execution
Flags svchost.exe creating new Office app processes (Word/Excel/PowerPoint/etc.), consistent with Office COM automation.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-13
- Updated
- 2026-07-31
What it detects
This rule flags process creation where svchost.exe spawns one of several Office application processes (eqnedt32.exe, excel.exe, msaccess.exe, mspub.exe, powerpnt.exe, visio.exe, winword.exe). Such behavior can indicate Office COM automation being triggered in a way attackers may use to generate or manipulate Office content. It relies on Windows process creation telemetry capturing the parent-child relationship and process image paths.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/office/troubleshoot/office-developer/automate-word-create-file-using-visual-basic
- github.comhttps://github.com/med0x2e/vba2clr
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_office_svchost_parent.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-svchost-spawning-office-applications-via-com-instance-creation-9bdaf1e9
title: Windows svchost.exe Spawning Office Applications via COM Object Execution
id: 4e719e5a-bcb0-43ab-8409-513decb6d158
status: test
description: This rule flags process creation where svchost.exe spawns one of several Office application processes (eqnedt32.exe, excel.exe, msaccess.exe, mspub.exe, powerpnt.exe, visio.exe, winword.exe). Such behavior can indicate Office COM automation being triggered in a way attackers may use to generate or manipulate Office content. It relies on Windows process creation telemetry capturing the parent-child relationship and process image paths.
references:
- https://learn.microsoft.com/en-us/previous-versions/office/troubleshoot/office-developer/automate-word-create-file-using-visual-basic
- https://github.com/med0x2e/vba2clr
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_office_svchost_parent.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-13
modified: 2023-12-19
tags:
- attack.execution
- detection.threat-hunting
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: \svchost.exe
Image|endswith:
- \eqnedt32.exe
- \excel.exe
- \msaccess.exe
- \mspub.exe
- \powerpnt.exe
- \visio.exe
- \winword.exe
condition: selection
falsepositives:
- Legitimate usage of office automation via scripting
level: medium
license: DRL-1.1
related:
- id: 9bdaf1e9-fdef-443b-8081-4341b74a7e28
type: derived