Detect a document or browser process spawning a scripting host

Siemphony@siemphonyhighT1203unverified

Matches process lineage where a client application that renders untrusted content — an Office application, a PDF reader, the equation editor, or a browser — is the parent of an interpreter or living-off-the-land binary. That parent/child pair is the observable side of successful client-side exploitation: the document or page itself is not in the telemetry, only the shell it obtained. The child list is MITRE's HighRiskChildren knob written out as literals. The analytic's full chain (Application EventID 1000 crash, then a write to a user-writable path, then outbound egress within a window) is a multi-source correlation Sigma cannot express, so the lineage event alone is authored here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0287, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\winword.exe" or InitiatingProcessFolderPath endswith "\\excel.exe" or InitiatingProcessFolderPath endswith "\\powerpnt.exe" or InitiatingProcessFolderPath endswith "\\outlook.exe" or InitiatingProcessFolderPath endswith "\\msaccess.exe" or InitiatingProcessFolderPath endswith "\\visio.exe" or InitiatingProcessFolderPath endswith "\\onenote.exe" or InitiatingProcessFolderPath endswith "\\eqnedt32.exe" or InitiatingProcessFolderPath endswith "\\acrord32.exe" or InitiatingProcessFolderPath endswith "\\acrobat.exe" or InitiatingProcessFolderPath endswith "\\foxitreader.exe" or InitiatingProcessFolderPath endswith "\\chrome.exe" or InitiatingProcessFolderPath endswith "\\msedge.exe" or InitiatingProcessFolderPath endswith "\\firefox.exe" or InitiatingProcessFolderPath endswith "\\iexplore.exe") and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\msiexec.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\schtasks.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe" OR ParentImage="*\\outlook.exe" OR ParentImage="*\\msaccess.exe" OR ParentImage="*\\visio.exe" OR ParentImage="*\\onenote.exe" OR ParentImage="*\\eqnedt32.exe" OR ParentImage="*\\acrord32.exe" OR ParentImage="*\\acrobat.exe" OR ParentImage="*\\foxitreader.exe" OR ParentImage="*\\chrome.exe" OR ParentImage="*\\msedge.exe" OR ParentImage="*\\firefox.exe" OR ParentImage="*\\iexplore.exe") AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\msiexec.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\curl.exe" OR Image="*\\schtasks.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\powerpnt.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\outlook.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\msaccess.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\visio.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\onenote.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\eqnedt32.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\acrord32.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\acrobat.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\foxitreader.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\chrome.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\msedge.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\firefox.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\iexplore.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msiexec.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\schtasks.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\winword\.exe$|\\excel\.exe$|\\powerpnt\.exe$|\\outlook\.exe$|\\msaccess\.exe$|\\visio\.exe$|\\onenote\.exe$|\\eqnedt32\.exe$|\\acrord32\.exe$|\\acrobat\.exe$|\\foxitreader\.exe$|\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$|\\iexplore\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\msiexec\.exe$|\\certutil\.exe$|\\bitsadmin\.exe$|\\curl\.exe$|\\schtasks\.exe$)</field>    <description>Detect a document or browser process spawning a scripting host</description>    <mitre>      <id>T1203</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c1ec8e56-668a-4132-9e6e-05773b40b2db

ATT&CKT1203

T1203Exploitation for Client Execution

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

Process lineage: an application that renders untrusted content — an Office app, a PDF reader, the Equation Editor, a browser — is the parent of an interpreter or living-off-the-land binary. The document or web page itself is never in the telemetry. Only the shell it obtained is. MITRE's AN0797 is a four-step chain: the client app crashes (Application EventID 1000), writes a file into a user-writable path (Sysmon 11), spawns an unexpected child (Sysmon 1), then connects out (Sysmon 3/22) — all inside a ~15-minute window. Sigma joins nothing across log sources, so the lineage event alone is authored. The crash is the link that would actually say exploitation; without it, this rule sees a parent/child pair and infers the rest.

02 · Telemetry you need

Sysmon EventID 1, or Security 4688 with Audit Process Creation enabled.
Unusually, command-line auditing is not required. This rule reads only
For the links the rule drops: the Application channel (EventID 1000) and

03 · How the logic works

Every term carries a leading backslash. endswith: '\powershell.exe' anchors on the path separator, so a dropped evilpowershell.exe does not satisfy it — without the backslash the suffix test is far looser than it looks. Attribution, precisely. MITRE's HighRiskChildren knob names eight binaries: powershell.exe, cmd.exe, wscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, msiexec.exe, curl.exe. The rule lists thirteen — pwsh.exe, cscript.exe, certutil.exe, bitsadmin.exe and schtasks.exe are the author's additions, and the rule's own description overstates this as "MITRE's HighRiskChildren knob written out as literals". The fifteen-entry parent list is entirely the author's; MITRE supplied no parents. Both sides are closed enumerations, and neither is closable in principle. The parent list omits msedgewebview2.exe (the embedded browser in Teams, the new Outlook, and every Electron-ish app), wordpad.exe and the archive viewers; the child list omits wmic.exe, msbuild.exe, installutil.exe and explorer.exe. Coverage is exactly as good as the maintenance of two literal lists — and the simplest evasion is to drop and run your own executable, since nothing in the rule requires a LOLBin at all. The honest scope problem. This lineage is identical for T1203 exploitation, T1204.002 user-executed macros and T1566.001 attachment phishing — and in practice the macro case supplies nearly all the true positives. Memory-corruption exploitation in a modern browser rarely produces a direct interpreter child of the renderer: the payload runs in the sandboxed content process, and the visible child is usually a dropped executable, not powershell.exe. The browser branch is the weakest part of this rule, and a learner who sees a clean board should not conclude their estate is free of client-side exploitation. The rule cannot see it. And the parents are not equal. eqnedt32.exe spawning anything is close to a certainty — CVE-2017-11882 and CVE-2018-0802 are the cleanest true positives here. chrome.exe spawning msiexec.exe is a browser update. One level: high for the union puts both in the same queue at the same priority.

04 · Common false positives

**outlook.exe → rundll32.exe is the loudest pair in the rule and is not
Office Click-to-Run self-repair spawning msiexec.exe.
Sanctioned internal workbooks whose VBA macros call cmd.exe or
Browser self-update and enterprise extension deployment.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0287 and never executed against a log line. level: high is a judgement about a union the reviewer argues should be split.
tier_2: means running it over history to see how much volume is Outlook's protocol handler, then baselining add-ins and updaters by parent command line.
tier_3: means adding the crash: Application EventID 1000 for the same client app immediately before the lineage event, inside MITRE's TimeWindow. That single join is what turns a macro-and-phishing detector into an exploitation detector.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter the protocol handlers on the child's CommandLine:
Apply MITRE's AllowedPlugins knob to the add-in's own child command line,
Invert the child side for the near-certain parents: for eqnedt32.exe, alert
UserPaths and EgressAllowlist need Sysmon 11 and 3 — different log

Declared by the author

Office add-ins and templates that legitimately shell out. A COM add-in repairing itself calls msiexec.exe, and several vendor add-ins invoke rundll32.exe on load. MITRE's AllowedPlugins knob is the intended suppression — allow-list the add-in's own child command line, not the child image on its own.
Sanctioned internal workbooks and documents whose VBA macros call cmd.exe or powershell.exe to refresh data or push a file. The lineage is identical to exploitation; only the document's origin distinguishes them, and that is not in this event.
Browser self-update and enterprise extension deployment, where chrome.exe or msedge.exe launches msiexec.exe or a signed updater. These recur on a fixed cadence under the same install path and should be baselined out by parent command line rather than by shrinking the child list.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1203, evaluated against their process_creation events.

Share this rule

/u/siemphony/c1ec8e56-668a-4132-9e6e-05773b40b2db

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect a document or browser process spawning a scripting host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it