SignalHunt
← All rules

SYS-4001

high

Office Application Spawning Command Interpreter

Detects a Microsoft Office application directly spawning a command interpreter or scripting engine - the classic execution step after a user opens a malicious macro-enabled document (phishing attachment).

T1566.001T1059.001

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "EventID": 1,
    "ParentImage|endswith": [
      "WINWORD.EXE",
      "EXCEL.EXE",
      "POWERPNT.EXE"
    ],
    "Image|endswith": [
      "cmd.exe",
      "powershell.exe",
      "wscript.exe",
      "cscript.exe"
    ]
  }
}

Log source: product=windows, service=sysmon · Event ID(s): 1

Required log fields

  • ParentImage
  • Image
  • CommandLine
  • User

Enabling this in your environment

Where: Sysmon configuration - ensure ProcessCreate (Event ID 1) is enabled with a config that captures ParentImage/CommandLine (e.g. SwiftOnSecurity's or Olaf Hartong's baseline sysmonconfig).

sysmon64.exe -c sysmonconfig.xml

Sysmon is a separate install, not built into Windows - requires Sysinternals Sysmon deployed with a config file that logs process creation with command-line capture enabled.

False positives

  • Legitimate add-ins or macros that shell out for approved automation (rare, should be an allow-listed exception, not the default)

References