Malicious documents, crafted archives, and file-handler vulnerabilities often rely on a trusted user application to reach native code execution. Endpoint process relationships can help reveal this transition.
The source defines a hunt for Microsoft Office applications, Adobe Reader, archive utilities, Windows Explorer, and Microsoft Management Console spawning command shells and other suspicious child processes.
Applications Included in the Hunt
The parent process list includes:
Microsoft Word;
Excel;
PowerPoint;
Outlook;
Adobe Reader;
7-Zip;
WinRAR;
Windows Explorer;
MMC.
The suspicious child process list includes command shells, scripting engines, LOLBins, scheduled-task tooling, and Windows Installer.
Detection Query
data.win.system.eventID:1 and data.win.eventdata.parentImage:(*\winword.exe or *\excel.exe or *\powerpnt.exe or *\outlook.exe or *\acrord32.exe or *\7zfm.exe or *\7zg.exe or *\winrar.exe or *\explorer.exe or *\mmc.exe) and data.win.eventdata.image:(*\cmd.exe or *\powershell.exe or *\pwsh.exe or *\mshta.exe or *\wscript.exe or *\cscript.exe or *\rundll32.exe or *\regsvr32.exe or *\certutil.exe or *\bitsadmin.exe or *\schtasks.exe or *\msiexec.exe)
The source associates the hunt with malicious-document and file-handler vulnerabilities including CVE-2025-0411, CVE-2025-24054, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633, CVE-2025-8088, CVE-2025-6218, and later Office or Windows Shell zero-days.
The query returned 621 results during the previous 30 days.
Interpreting the Behavior
Not every child process is malicious. Some documents contain legitimate automation, enterprise software may register file handlers, and archive utilities can invoke helper applications.
The important question is whether the process relationship is expected for the specific user, host, and workflow.
For example, winword.exe → powershell.exe on a normal office workstation is substantially more interesting than a known deployment tool invoking msiexec.exe.
Investigation Steps
For each suspicious event, review:
the original parent application;
the file being opened if available;
command-line arguments;
user identity;
source path of the document or archive;
file hashes;
network connections;
additional child processes;
files created after execution.
If the chain continues into download utilities, script interpreters, or persistence commands, the event should receive higher priority.
Reducing False Positives
Start by grouping results by process pair and command line. The 621 events in the source may collapse into a small number of repeated legitimate patterns.
Good exclusions are narrow and explainable. They should describe a specific approved workflow rather than remove an entire application from monitoring.
Detection Value
This hunt is useful because it does not require a signature for every malicious document or archive. It monitors the behavior that often follows successful exploitation.
That makes it a practical detection layer for endpoint environments where Office files, archives, PDFs, and administrative consoles remain common attack surfaces.
