Analytics BIOC
Low
✕
Microsoft Office process spawns a commonly abused process
Microsoft Office process spawns a commonly abused process with an uncommon command.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002) Initial Access (TA0001)
ATT&CK techniques: User Execution (T1204) Phishing: Spearphishing Attachment (T1566.001)
Attacker's goals:
An attacker attempts to gain code execution via a phishing document.
Investigative actions:
Check the source of the document (received by mail or loaded locally). Investigate the child processes for malicious activity and network connections to an external host.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day