Suspicious Microsoft Office Child Process

심각도 높음 Sigma 탐지 룰. Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

작성자: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · 원본 라이선스: DRL 1.1 · SigmaHQ 원본