attack.t1137.002 | Detection.FYI

Suspicious Microsoft Office Child Process - MacOS

Dec 1, 2023 · attack.execution attack.persistence attack.t1059.002 attack.t1137.002 attack.t1204.002 ·
Share on:

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

Read More
Office Application Startup - Office Test

Nov 8, 2023 · attack.persistence attack.t1137.002 ·
Share on:

Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started

Read More