Office application launching a shell or script host

Threat behaviour covered

Malicious documents typically run code by having the Office application start a command shell or script interpreter. Office programs rarely do this in normal use.

Detection logic

DeviceProcessEvents
| where TimeGenerated > ago(1d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine
| order by TimeGenerated desc

Data sources

• Microsoft Defender for Endpoint DeviceProcessEvents, connected to Sentinel (in Defender advanced hunting, use Timestamp instead of TimeGenerated)

False positives and tuning

• Add-ins and line-of-business macros that legitimately call a script host; review the command lines and allow-list known ones.

Limitations

• Only sees what the endpoint sensor reports. Document-based attacks that load code in-process without spawning a child will not match.