Microsoft Office Process Spawning a Suspicious One-Liner

Analytics BIOC Low

Microsoft Office Process Spawning a Suspicious One-Liner

A Microsoft Office process spawned a commonly abused process with a full command (not a script), this is a typically malicious behavior.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Execution (TA0002) Initial Access (TA0001)

ATT&CK techniques: User Execution (T1204) Phishing: Spearphishing Attachment (T1566.001)

Attacker's goals:

An attacker is trying to gain code execution on the host.

Investigative actions:

Check whether the command line executed is benign or normal for the host and/or user performing it. For example, employees working in finance may have legitimate use cases for complex Excel commands.

Test period:: N/A (single event)
Deduplication:: 1 Day