BIOC
Informational
✕
Microsoft Office process spawns an unsigned process
Common weaponized office document behavior.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: User Execution (T1204)
Indicator:
Process action type = execution AND process execution signature = Unsigned , Invalid Signature , N/A , Weak Hash Process initiated by = outlook.exe , excel.exe , winword.exe , powerpnt.exe , visio.exe , winproj.exe , onenote.exe , msaccess.exe Host host os = windows
Preventable: yes